CVE-2022-4107: SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download
The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4107?
CVE-2022-4107 is a vulnerability in the SMSA Shipping for WooCommerce WordPress plugin before version 1.0.5 that allows authenticated users to download arbitrary files from the server.
What is the severity of CVE-2022-4107?
The severity of CVE-2022-4107 is medium with a CVSS score of 6.5.
How does CVE-2022-4107 affect the SMSA Shipping for WooCommerce WordPress plugin?
CVE-2022-4107 affects the SMSA Shipping for WooCommerce WordPress plugin before version 1.0.5 by not having proper authorization and CSRF checks, allowing authenticated users to download arbitrary files from the server.
How can I fix CVE-2022-4107?
To fix CVE-2022-4107, update the SMSA Shipping for WooCommerce WordPress plugin to version 1.0.5 or later.
What is CWE-352 and CWE-552?
CWE-352 is Cross-Site Request Forgery (CSRF) and CWE-552 is Files or Directories Accessible to External Parties.