CVE-2022-3477

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-3477", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "dateUpdated": "2025-04-30T19:15:06.272Z", "dateReserved": "2022-10-12T00:00:00.000Z", "datePublished": "2022-11-14T00:00:00.000Z"}, "containers": {"cna": {"title": "tagDiv Composer < 3.5 - Unauthenticated Account Takeover", "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2022-11-14T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address"}], "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"version": "3.5", "status": "affected", "lessThan": "3.5", "versionType": "custom"}]}, {"vendor": "tagDiv", "product": "Newspaper", "versions": [{"version": "12.1", "status": "affected", "lessThan": "12.1", "versionType": "custom"}]}, {"vendor": "tagDiv", "product": "Newsmag", "versions": [{"version": "5.2.2", "status": "affected", "lessThan": "5.2.2", "versionType": "custom"}]}], "references": [{"url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef"}], "credits": [{"lang": "en", "value": "Truoc Phan"}], "problemTypes": [{"descriptions": [{"type": "CWE", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "lang": "en"}]}], "x_generator": "WPScan CVE Generator", "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:14:01.441Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-30T19:14:51.185195Z", "id": "CVE-2022-3477", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T19:15:06.272Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:14:01.441Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-3477", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-30T19:14:51.185195Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T19:15:03.263Z"}}], "cna": {"title": "tagDiv Composer < 3.5 - Unauthenticated Account Takeover", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Truoc Phan"}], "affected": [{"vendor": "tagDiv", "product": "tagDiv Composer", "versions": [{"status": "affected", "version": "3.5", "lessThan": "3.5", "versionType": "custom"}]}, {"vendor": "tagDiv", "product": "Newspaper", "versions": [{"status": "affected", "version": "12.1", "lessThan": "12.1", "versionType": "custom"}]}, {"vendor": "tagDiv", "product": "Newsmag", "versions": [{"status": "affected", "version": "5.2.2", "lessThan": "5.2.2", "versionType": "custom"}]}], "references": [{"url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef"}], "x_generator": "WPScan CVE Generator", "descriptions": [{"lang": "en", "value": "The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2022-11-14T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3477", "state": "PUBLISHED", "dateUpdated": "2025-04-30T19:15:06.272Z", "dateReserved": "2022-10-12T00:00:00.000Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2022-11-14T00:00:00.000Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "tagDiv Composer", "vendor": "tagDiv", "versions": [{"lessThan": "3.5", "status": "affected", "version": "3.5", "versionType": "custom"}]}, {"product": "Newspaper", "vendor": "tagDiv", "versions": [{"lessThan": "12.1", "status": "affected", "version": "12.1", "versionType": "custom"}]}, {"product": "Newsmag", "vendor": "tagDiv", "versions": [{"lessThan": "5.2.2", "status": "affected", "version": "5.2.2", "versionType": "custom"}]}], "source": "contact@wpscan.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "98B27918-A366-4CC1-A391-356969E6CB1A", "versionEndExcluding": "5.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:newspaper_project:newspaper:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DBB5920F-1041-458B-AF52-97714769C273", "versionEndExcluding": "12.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tagdiv_composer_project:tagdiv_composer:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "B4D12BBD-39CC-49F9-BA78-956D9BA609C0", "versionEndExcluding": "3.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address"}, {"lang": "es", "value": "El complemento de WordPress tagDiv Composer anterior a 3.5, requerido por el tema Newspaper WordPress anterior a 12.1 y el tema Newsmag de WordPress anterior a 5.2.2, no implementa correctamente la funci\u00f3n de inicio de sesi\u00f3n de Facebook, lo que permite a atacantes no autenticados iniciar sesi\u00f3n como cualquier usuario con solo conocer su direcci\u00f3n de correo electr\u00f3nico."}], "id": "CVE-2022-3477", "lastModified": "2026-06-17T04:59:36.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-3477", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-30T19:14:51.185195Z", "version": "2.0.3"}}]}, "published": "2022-11-14T15:15:49.257", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "contact@wpscan.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}