cvelist/2022/3xxx/CVE-2022-3097.json

{
  "CVE_data_meta": {
    "ID": "CVE-2022-3097",
    "ASSIGNER": "contact@wpscan.com",
    "STATE": "PUBLIC",
    "TITLE": "LBStopAttack <= 1.1.2 - Arbitrary Settings Update via CSRF"
  },
  "data_format": "MITRE",
  "data_type": "CVE",
  "data_version": "4.0",
  "generator": "WPScan CVE Generator",
  "affects": {
    "vendor": {
      "vendor_data": [
        {
          "vendor_name": "Unknown",
          "product": {
            "product_data": [
              {
                "product_name": "Plugin LBstopattack",
                "version": {
                  "version_data": [
                    {
                      "version_affected": "<=",
                      "version_name": "1.1.2",
                      "version_value": "1.1.2"
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  },
  "description": {
    "description_data": [
      {
        "lang": "eng",
        "value": "The LBStopAttack WordPress plugin through 1.1.2 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections."
      }
    ]
  },
  "references": {
    "reference_data": [
      {
        "refsource": "MISC",
        "url": "https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43",
        "name": "https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43"
      }
    ]
  },
  "problemtype": {
    "problemtype_data": [
      {
        "description": [
          {
            "value": "CWE-352 Cross-Site Request Forgery (CSRF)",
            "lang": "eng"
          }
        ]
      }
    ]
  },
  "credit": [
    {
      "lang": "eng",
      "value": "Daniel Ruf"
    }
  ],
  "source": {
    "discovery": "EXTERNAL"
  }
}