CVE-2022-2864 - The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7

Back Back to CVE browser

HIGH

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7

Published Oct 28, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.52%

Description

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

Vendor Demonisblack Product Demon Image Annotation Default
unaffected
- Version
  1.0
  Status
  affected
  Constraints
  <=4.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Demonisblack

Demon Image Annotation

unaffected

Version	Status	Constraints
1.0	affected	<=4.7

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35098
Advisory
https://plugins.trac.wordpress.org/browser/demon-image-annotation/trunk/includes/settings.php
PatchThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2772352%40demon-image-annotation&new=2772352%40demon-image-annotation&sfp_email=&sfph_mail=
PatchThird Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2864
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35098		Advisory
https://plugins.trac.wordpress.org/browser/demon-image-annotation/trunk/includes/settings.php		PatchThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2772352%40demon-image-annotation&new=2772352%40demon-image-annotation&sfp_email=&sfph_mail=		PatchThird Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2864		Third Party Advisory