daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: cves/2022/CVE-2022-1398.yaml by md

patch-1
MostInterestingBotInTheWorld 2023-04-06 17:44:48 -04:00
parent 5b7b47a801
commit 057f1f3141
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cves/2022/CVE-2022-1398.yaml
View File

@ -1,11 +1,11 @@
id: CVE-2022-1398
info:
name: External Media without Import <= 1.1.2 - Authenticated Blind SSRF
name: External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
author: theamanrawat
severity: medium
description: |
The External Media without Import WordPress plugin through 1.1.2 does not have any authorization and does not ensure that media added via URLs are external media, which could allow any authenticated users (including subscriber) to perform blind SSRF attacks.
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
reference:
- https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
- https://wordpress.org/plugins/external-media-without-import/
@ -51,3 +51,5 @@ requests:
part: body_2
words:
- "external-media-without-import"
# Enhanced by md on 2023/04/06