CVE Vulnerability

CVE-2022-3762

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/96ef4bb8-a054-48ae-b29c-b3060acd01ac Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:elite:wordpress:*:*
cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:plus:wordpress:*:*
Information

Published : 2022-11-21 11:15

Updated : 2022-11-23 03:18

NVD link : CVE-2022-3762

Mitre link : CVE-2022-3762

Products Affected
No products.
CWE
CWE-22