CVE-2022-0875CWE-352

miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting

published June 27, 2022

CVSS
—
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-06-27T08:55Z
EPSS history
Timeline
  • 27 JUN 08:55Z
    miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting
    cvelistv5