{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable."
    },
    {
      "lang": "es",
      "value": "El SDK de Freemius, tal como lo utilizan cientos de desarrolladores de complementos y temas de WordPress, era vulnerable a Cross-Site Request Forgery y divulgaci\u00f3n de informaci\u00f3n debido a la falta de comprobaciones de capacidad y protecci\u00f3n de nonce en las funciones _get_debug_log, _get_db_option y _set_db_option en versiones hasta la 2.4.2 incluida. Cualquier complemento o tema de WordPress que ejecute una versi\u00f3n de Freemius anterior a la 2.4.3 es vulnerable."
    }
  ],
  "id": "CVE-2022-4974",
  "lastModified": "2024-10-16T16:38:14.557",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-16T07:15:12.760",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://freemius.com/blog/managing-security-issues-open-source-freemius-sdk-security-disclosure/"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://web.archive.org/web/20220225174410/https%3A//www.pluginvulnerabilities.com/2022/02/25/our-security-review-of-wordpress-plugin-found-freemius-library-still-contained-vulnerabilities-3-years-after-major-security-incident/"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://wpdirectory.net/search/01FWPVWA7BC5DYGZHNSZQ9QMN5"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://wpdirectory.net/search/01G02RSGMFS1TPT63FS16RWEYR"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Primary"
    }
  ]
}