CVE-2022-3459 Vulnerability Details

  /     /     /  

CVE-2022-3459 Metadata Quick Info

CVE Published: 14/09/2024 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: Wordfence | Vendor: ankitpokhrel | Product: WooCommerce Multiple Free Gift
Status : PUBLISHED

---

CVE-2022-3459 Description

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.

Metrics

CVSS Version: 3.1 | Base Score: 5.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-639
CWE Name: CWE-639 Authorization Bypass Through User-Controlled Key
Source: ankitpokhrel

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).