PatchTheCVEhermit vulnerabilities and fixes
Recent CVEs affecting hermit, with upgrade or downgrade steps. 4 tracked.
hermit has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-04-28. Highest priority: CVE-2022-29411 (score 50/100).
- CVE-2022-29413 MEDIUM 4.7 UPGRADE Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin
- CVE-2022-29412 MEDIUM 5.4 UPGRADE Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow
- CVE-2022-29411 HIGH 8.3 UPGRADE SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to e
- CVE-2022-29410 HIGH 7.4 UPGRADE Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows
FAQ
How do I fix hermit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hermit being exploited right now?
None of the tracked hermit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hermit CVE should I patch first?
CVE-2022-29411 currently ranks highest (50/100): SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to e.