CVE-2022-0444

{"containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2023-07-24T09:55:42.558Z"}, "title": "XCloner < 4.3.6 - Plugin Settings Reset", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin", "versions": [{"status": "affected", "versionType": "custom", "version": "0", "lessThan": "4.3.6"}], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key."}], "references": [{"url": "https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Krzysztof Zaj\u0105c", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:25:40.479Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-0444", "datePublished": "2022-06-27T08:55:47.000Z", "dateReserved": "2022-02-01T00:00:00.000Z", "dateUpdated": "2024-08-02T23:25:40.479Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "product": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin", "vendor": "Unknown", "versions": [{"lessThan": "4.3.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "contact@wpscan.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:watchful:xcloner:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "5D872894-B1D5-4AFD-8F7B-1FFE5900CA5D", "versionEndExcluding": "4.3.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key."}, {"lang": "es", "value": "El plugin Backup, Restore and Migrate WordPress Sites With the XCloner Plugin de WordPress versiones anteriores a 4.3.6, no dispone de comprobaciones de autorizaci\u00f3n y de tipo CSRF cuando son restablecidos sus ajustes, lo que permite a atacantes no autenticados restablecerlos, incluyendo la generaci\u00f3n de una nueva clave de cifrado de la copia de seguridad"}], "id": "CVE-2022-0444", "lastModified": "2026-06-17T04:20:36.577", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-27T09:15:08.390", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}