CVE-2022-1424 Ask Me < 6.8.2 - Multiple CSRF in AJAX Actions

Q: What is CVE-2022-1424?

CVE-2022-1424 is a medium-severity vulnerability in Unknown Ask me, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2022-1424 being exploited?

There is no known exploitation of CVE-2022-1424 in the wild and no public exploit code.

Q: How do I fix CVE-2022-1424?

No fix has been published for CVE-2022-1424 yet. Limit exposure of the affected software until one is available.

Medium 6.5 Published 6 Jun 2022 Updated 3 Aug 2024

Attackers can trick logged-in users into performing unauthorized actions via AJAX due to missing CSRF checks in the Ask Me WordPress theme.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-1424?

CVE-2022-1424 is a medium-severity vulnerability in Unknown Ask me, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.

Weakness: CWE-352

Which versions are affected by CVE-2022-1424?

It affects 1 product.

Products include 2code Ask Me.

How do I fix CVE-2022-1424?

No fix has been published for CVE-2022-1424 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-1424 being exploited?

There is no known exploitation of CVE-2022-1424 in the wild and no public exploit code.

CVE-2022-1241 Ask Me < 6.8.2 - Reflected Cross-Site Scripting Medium 6.1

Sources

Also known as GHSA-gw4p-2m2w-qw96.