CVE-2022-36285

2022-08-2316:15:11

CWE-434

[email protected]

web.nvd.nist.gov

cve-2022-36285

authenticated

arbitrary file upload

dmitrylitvinov

svg

webp

ico

wordpress

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

42.9%

JSON

Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

Affected configurations

Vulners

NVD

Node

dmitrylitvinovuploading_svg\,_webp_and_ico_files_\(wordpress_plugin\)Range≤1.0.1

CPENameOperatorVersion
uploading_svg\,_webp_and_ico_files_project:uploading_svg\,_webp_and_ico_filesuploading svg, webp and ico files project uploading svg, webp and ico filesle1.0.1

CPE	Name	Operator	Version
uploading_svg\,_webp_and_ico_files_project:uploading_svg\,_webp_and_ico_files	uploading svg, webp and ico files project uploading svg, webp and ico files	le	1.0.1

CNA Affected

[
  {
    "product": "Uploading SVG, WEBP and ICO files (WordPress plugin)",
    "vendor": "dmitrylitvinov",
    "versions": [
      {
        "lessThanOrEqual": "1.0.1",
        "status": "affected",
        "version": "<= 1.0.1",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-arbitrary-file-upload-vulnerability

wordpress.org/plugins/uploading-svgwebp-and-ico-files/#developers