Lucene search

WPScanCVE-2022-1977

HistoryJun 27, 2022 - 9:15 a.m.

CVE-2022-1977

2022-06-2709:15:10

CWE-918

WPScan

web.nvd.nist.gov

cve-2022-1977

wordpress

plugin

ssrf

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.3%

JSON

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks

Affected configurations

Nvd

Vulners

Node

smackcodersimport_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csvRange<6.5.3wordpress

VendorProductVersionCPE
smackcodersimport_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv*cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:*

Vendor	Product	Version	CPE
smackcoders	import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv	*	cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:::::wordpress:::*

CNA Affected

[
  {
    "product": "Import Export All WordPress Images, Users & Post Types",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "6.5.3",
        "status": "affected",
        "version": "6.5.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.3%

JSON

Related for CVE-2022-1977