CVE-2022-3024CWE-352CWE-863

Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS

Medium · published September 26, 2022

CVSS v3.1
5.4
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-863 · Incorrect Authorization
Published
2022-09-26T00:00Z
EPSS history
Timeline
  • 26 SEP 00:00Z
    Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
    cvelistv5