CVE-2022-2877

Published Sep 16, 2022

Last updated 2 years ago

CVSS medium 5.3

Overview

Description: The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

contact@wpscan.com: CWE-639

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cm-wp:titan_anti-spam_\\&_security:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "69D408EB-20B0-4255-A947-FA6635E6ED3F",
            "versionEndExcluding": "7.3.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References