Medium severity · published Oct 25, 2022
CVE-2022-3097
LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plugin LBstopattack ·
before 1.1.3 · source: vendor
LB
Lbstopattack · Laubrotel
through 1.1.2 · source: NVD