Vulnerabilites related to newspaper_project - newspaper
CVE-2022-3477 (GCVE-0-2022-3477)
Vulnerability from cvelistv5
Published
2022-11-14 00:00
Modified
2025-04-30 19:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T01:14:01.441Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2022-3477", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-04-30T19:14:51.185195Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-04-30T19:15:06.272Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tagDiv Composer", "vendor": "tagDiv", "versions": [ { "lessThan": "3.5", "status": "affected", "version": "3.5", "versionType": "custom" } ] }, { "product": "Newspaper", "vendor": "tagDiv", "versions": [ { "lessThan": "12.1", "status": "affected", "version": "12.1", "versionType": "custom" } ] }, { "product": "Newsmag", "vendor": "tagDiv", "versions": [ { "lessThan": "5.2.2", "status": "affected", "version": "5.2.2", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Truoc Phan" } ], "descriptions": [ { "lang": "en", "value": "The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-11-14T00:00:00.000Z", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan" }, "references": [ { "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef" } ], "source": { "discovery": "EXTERNAL" }, "title": "tagDiv Composer \u003c 3.5 - Unauthenticated Account Takeover", "x_generator": "WPScan CVE Generator" } }, "cveMetadata": { "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-3477", "datePublished": "2022-11-14T00:00:00.000Z", "dateReserved": "2022-10-12T00:00:00.000Z", "dateUpdated": "2025-04-30T19:15:06.272Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Vulnerability from fkie_nvd
Published
2022-11-14 15:15
Modified
2025-04-30 20:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
References
▼ | URL | Tags | |
---|---|---|---|
contact@wpscan.com | https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef | Exploit, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
newsmag_project | newsmag | * | |
newspaper_project | newspaper | * | |
tagdiv_composer_project | tagdiv_composer | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "98B27918-A366-4CC1-A391-356969E6CB1A", "versionEndExcluding": "5.2.2", "vulnerable": true }, { "criteria": "cpe:2.3:a:newspaper_project:newspaper:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DBB5920F-1041-458B-AF52-97714769C273", "versionEndExcluding": "12.1", "vulnerable": true }, { "criteria": "cpe:2.3:a:tagdiv_composer_project:tagdiv_composer:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "B4D12BBD-39CC-49F9-BA78-956D9BA609C0", "versionEndExcluding": "3.5", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address" }, { "lang": "es", "value": "El complemento de WordPress tagDiv Composer anterior a 3.5, requerido por el tema Newspaper WordPress anterior a 12.1 y el tema Newsmag de WordPress anterior a 5.2.2, no implementa correctamente la funci\u00f3n de inicio de sesi\u00f3n de Facebook, lo que permite a atacantes no autenticados iniciar sesi\u00f3n como cualquier usuario con solo conocer su direcci\u00f3n de correo electr\u00f3nico." } ], "id": "CVE-2022-3477", "lastModified": "2025-04-30T20:15:18.973", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] }, "published": "2022-11-14T15:15:49.257", "references": [ { "source": "contact@wpscan.com", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef" } ], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-287" } ], "source": "contact@wpscan.com", "type": "Primary" }, { "description": [ { "lang": "en", "value": "CWE-287" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Primary" } ] }