CVE-2022-3930
Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
Medium · published December 12, 2022
What it is
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00636 · 49.8th percentile
- Published
- 2022-12-12T17:54Z
EPSS history
Timeline