CVE-2022-3374

2022-10-3116:15:11

CWE-502

WPScan

web.nvd.nist.gov

ocean extra

wordpress plugin

cve-2022-3374

nvd

security

php object injection

gadget chain

privilege user

customizer styling file

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.9%

JSON

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

Affected configurations

Nvd

Vulners

Node

oceanwpocean_extraRange<2.0.5wordpress

VendorProductVersionCPE
oceanwpocean_extra*cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
oceanwp	ocean_extra	*	cpe:2.3:a:oceanwp:ocean_extra::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ocean Extra",
    "versions": [
      {
        "version": "2.0.5",
        "status": "affected",
        "lessThan": "2.0.5",
        "versionType": "custom"
      }
    ]
  }
]