Lucene search

WPScanCVE-2022-3359

HistoryDec 12, 2022 - 6:15 p.m.

CVE-2022-3359

2022-12-1218:15:10

WPScan

web.nvd.nist.gov

cve-2022-3359

wordpress plugin

phlox theme

security

php object injection

nvd

vulnerability

file import

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Affected configurations

Nvd

Vulners

Node

avertashortcodes_and_extra_features_for_phlox_themeRange<2.10.7wordpress

VendorProductVersionCPE
avertashortcodes_and_extra_features_for_phlox_theme*cpe:2.3:a:averta:shortcodes_and_extra_features_for_phlox_theme:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
averta	shortcodes_and_extra_features_for_phlox_theme	*	cpe:2.3:a:averta:shortcodes_and_extra_features_for_phlox_theme::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Shortcodes and extra features for Phlox theme",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.10.7"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

Related for CVE-2022-3359