CVE-2022-2912

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
UnknownCraw Data>= 1.0.0, <= 1.0.0

References

Timeline

Published
Sep 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-291206.5Windows Clustered Shared Volume Information Disclosure VulnerabilityCVE-2022-291216.5Windows WLAN AutoConfig Service Denial of Service VulnerabilityCVE-2022-291226.5Windows Clustered Shared Volume Information Disclosure VulnerabilityCVE-2022-291236.5Windows Clustered Shared Volume Information Disclosure VulnerabilityCVE-2022-291257.0Windows Push Notifications Apps Elevation of Privilege VulnerabilityCVE-2022-291267.0Tablet Windows User Interface Application Core Elevation of Privilege VulnerabilityCVE-2022-291274.2BitLocker Security Feature Bypass VulnerabilityCVE-2022-291288.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-291298.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-29134.3The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on tCVE-2022-291309.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-291318.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVE-2022-2912: Medium severity, CVSS 4.3 | Vulnix