CVE-2022-0279 AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition

Q: What is CVE-2022-0279?

CVE-2022-0279 is a low-severity vulnerability in Unknown AnyComment, published on 21 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Q: Is CVE-2022-0279 being exploited?

There is no known exploitation of CVE-2022-0279 in the wild and no public exploit code.

Q: How do I fix CVE-2022-0279?

No fix has been published for CVE-2022-0279 yet. Limit exposure of the affected software until one is available.

Low 3.1 Published 21 Feb 2022 Updated 2 Aug 2024

Authenticated users can exploit a race condition to manipulate comment ratings, requiring an upgrade to the AnyComment plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0279?

CVE-2022-0279 is a low-severity vulnerability in Unknown AnyComment, published on 21 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users

Weakness: CWE-362

Which versions are affected by CVE-2022-0279?

It affects 1 product.

Products include Bologer Anycomment.

How do I fix CVE-2022-0279?

No fix has been published for CVE-2022-0279 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-0279 being exploited?

There is no known exploitation of CVE-2022-0279 in the wild and no public exploit code.

Sources

Also known as GHSA-g7w5-4hph-r98m.