Lucene search
HistoryOct 25, 2022 - 5:15 p.m.
CVE-2022-3335
kadence woocommerce
wordpress plugin
php object injection
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
42.9%
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Affected configurations
Node
kadencewpkadence_woocommerce_email_designerRange<1.5.7wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| kadencewp | kadence_woocommerce_email_designer | * | cpe:2.3:a:kadencewp:kadence_woocommerce_email_designer:*:*:*:*:*:wordpress:*:* |
Related
cve
cve
CVE-2022-3335
2022-10-25 17:15:57
wpexploit
wpexploit
Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
2022-10-03 00:00:00
openvas
openvas
patchstack
patchstack
cvelist
cvelist
wpvulndb
wpvulndb
Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
2022-10-03 00:00:00
prion
prion
Design/Logic Flaw
2022-10-25 17:15:00
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
42.9%
Related for NVD:CVE-2022-3335