CVE-2022-2092 - Vulnerability Details - OpenCVE

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wpovernight	Woocommerce Pdf Invoices\& Packing Slips

Configuration 1 [-]

cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d

History

No history.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2022-07-11T12:57:25

Updated: 2024-08-03T00:24:44.204Z

Reserved: 2022-06-15T00:00:00

Link: CVE-2022-2092

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-11T13:15:09.317

Modified: 2024-11-21T07:00:18.350

Link: CVE-2022-2092

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "WooCommerce PDF Invoices & Packing Slips", "vendor": "Unknown", "versions": [{"lessThan": "2.16.0", "status": "affected", "version": "2.16.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "ZhongFu Su(JrXnm) of WuHan University"}], "descriptions": [{"lang": "en", "value": "The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-11T12:57:25", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d"}], "source": {"discovery": "EXTERNAL"}, "title": "WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-2092", "STATE": "PUBLIC", "TITLE": "WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WooCommerce PDF Invoices & Packing Slips", "version": {"version_data": [{"version_affected": "<", "version_name": "2.16.0", "version_value": "2.16.0"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "ZhongFu Su(JrXnm) of WuHan University"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.204Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-2092", "datePublished": "2022-07-11T12:57:25", "dateReserved": "2022-06-15T00:00:00", "dateUpdated": "2024-08-03T00:24:44.204Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\\&_packing_slips:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "6BF7CE00-25C0-4DE3-A277-C7A377881EE8", "versionEndExcluding": "2.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks."}, {"lang": "es", "value": "El plugin WooCommerce PDF Invoices & Packing Slips de WordPress versiones anteriores a 2.16.0, no escapa de un par\u00e1metro en su p\u00e1gina de configuraci\u00f3n, lo que hace posible a atacantes conducir ataques de tipo cross-site scripting reflejados"}], "id": "CVE-2022-2092", "lastModified": "2024-11-21T07:00:18.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-11T13:15:09.317", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/87546554-276a-45fe-b2aa-b18bfc55db2d"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Secondary"}]}