8.8high
CVE-2022-1900
Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting
Published 4 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
0.60% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- robmcvey Copify
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- wordfence.com /threat-intel/vulnerabilities/id/e92c6374-d11d-458c-b089-0ee79c33e4a6?source=cve · x_transferred
- wordfence.com /vulnerability-advisories/#CVE-2022-1900 · x_transferred
Sources
- CVE List: CVE-2022-1900
- NVD: CVE-2022-1900
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.