CVE-2022-36422 - OpenCVE

Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wp-postratings Project	Wp-postratings

Configuration 1 [-]

cpe:2.3:a:wp-postratings_project:wp-postratings:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve
https://wordpress.org/plugins/wp-postratings/#developers

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-09-09T14:39:52.886597Z

Updated: 2024-09-17T01:41:46.763Z

Reserved: 2022-08-09T00:00:00

Link: CVE-2022-36422

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-09-09T15:15:10.697

Modified: 2022-09-10T03:49:48.663

Link: CVE-2022-36422

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "WP-PostRatings (WordPress plugin)", "vendor": "Lester 'GaMerZ' Chan", "versions": [{"lessThanOrEqual": "1.89", "status": "affected", "version": "<= 1.89", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by Nguy Minh Tuan (Patchstack Alliance)"}], "datePublic": "2022-08-31T00:00:00", "descriptions": [{"lang": "en", "value": "Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Race condition", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-09T14:39:52", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/wp-postratings/#developers"}], "solutions": [{"lang": "en", "value": "Update to 1.90 or higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-08-31T07:24:00.000Z", "ID": "CVE-2022-36422", "STATE": "PUBLIC", "TITLE": "WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WP-PostRatings (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 1.89", "version_value": "1.89"}]}}]}, "vendor_name": "Lester 'GaMerZ' Chan"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by Nguy Minh Tuan (Patchstack Alliance)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Race condition"}]}]}, "references": {"reference_data": [{"name": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve", "refsource": "CONFIRM", "url": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve"}, {"name": "https://wordpress.org/plugins/wp-postratings/#developers", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/wp-postratings/#developers"}]}, "solution": [{"lang": "en", "value": "Update to 1.90 or higher version."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:07:34.067Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/wp-postratings/#developers"}]}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2022-36422", "datePublished": "2022-09-09T14:39:52.886597Z", "dateReserved": "2022-08-09T00:00:00", "dateUpdated": "2024-09-17T01:41:46.763Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp-postratings_project:wp-postratings:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "2D075BD7-767A-4DF2-951B-EF91B9F5C7F6", "versionEndIncluding": "1.89", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress."}, {"lang": "es", "value": "Un aumento/disminuci\u00f3n de la calificaci\u00f3n por medio de una condici\u00f3n de carrera en el plugin WP-PostRatings de Lester \"GaMerZ\" Chan versiones anteriores a 1.89 incluy\u00e9ndola, en WordPress"}], "id": "CVE-2022-36422", "lastModified": "2022-09-10T03:49:48.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2022-09-09T15:15:10.697", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-89-rating-increase-decrease-via-race-condition-vulnerability/_s_id=cve"}, {"source": "audit@patchstack.com", "tags": ["Product", "Release Notes"], "url": "https://wordpress.org/plugins/wp-postratings/#developers"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}