CVE-2022-0914
Medium
Description
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
SeverityMedium
CVSS6.5
Exploit probability—
ProductAtlasgondal Export All Urls
PublishedApr 11, 2022
First seenApr 11, 2022
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- atlasgondal export_all_urls4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlasgondal export_all_urls | v < 4.3 | 4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.