Lucene search

WordfenceCVE-2022-0889

HistoryMar 23, 2022 - 8:15 p.m.

CVE-2022-0889

2022-03-2320:15:10

CWE-79

Wordfence

web.nvd.nist.gov

cve-2022-0889

ninja forms

file uploads extension

wordpress plugin

reflected xss

vulnerability

nvd

security issue

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.5%

JSON

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.

Affected configurations

Nvd

Vulners

Node

ninjaformsninja_forms_file_uploadsRange≤3.3.12wordpress

VendorProductVersionCPE
ninjaformsninja_forms_file_uploads*cpe:2.3:a:ninjaforms:ninja_forms_file_uploads:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ninjaforms	ninja_forms_file_uploads	*	cpe:2.3:a:ninjaforms:ninja_forms_file_uploads::::::wordpress::*

CNA Affected

[
  {
    "vendor": "SaturdayDrive",
    "product": "Ninja Forms - File Uploads",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.3.12",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

ninjaforms.com/extensions/file-uploads/?changelog=1/#:~:text=3.3.13%20(30%20November%202021)

www.wordfence.com/threat-intel/vulnerabilities/id/8c5642fa-d001-47c4-8acd-94ae944e5129?source=cve

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.5%

JSON

Related for CVE-2022-0889