Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-0398

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website

Published

2022-04-25T16:16:07.640

Last Modified

2024-11-21T06:38:32.567

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-352
    CWE-862
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application caseproof thirstyaffiliates_affiliate_link_manager < 3.10.5 Yes
References