CVE-2022-3082

miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

Medium · published October 17, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Published
2022-10-17T00:00Z
EPSS history
Timeline
  • 17 OCT 00:00Z
    miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
    cvelistv5