CVE-2022-3400

Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template on the vulnerable WordPress website.

El tema Bricks para WordPress es vulnerable a la omisión de autorización debido a una falta de verificación de capacidad en la acción AJAX bricks_save_post en las versiones 1.0 a 1.5.3. Esto hace posible que atacantes autenticados con permisos mínimos, como un suscriptor, editen cualquier página, publicación o plantilla en el sitio web vulnerable de WordPress.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Complete

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-10-03 CVE Reserved
2022-10-03 CVE Published
2024-08-03 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-862: Missing Authorization

CAPEC

References (2)

URL	Tag	Source
https://bricksbuilder.io	Product
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3400	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Bricksbuilder Search vendor "Bricksbuilder"		Bricks Search vendor "Bricksbuilder" for product "Bricks"				>= 1.0 <= 1.5.3 Search vendor "Bricksbuilder" for product "Bricks" and version " >= 1.0 <= 1.5.3"		wordpress		Affected