From e4f62192b27dcf58584e04d77b877bd71ec9a06c Mon Sep 17 00:00:00 2001 From: MostInterestingBotInTheWorld <98333686+MostInterestingBotInTheWorld@users.noreply.github.com> Date: Mon, 10 Apr 2023 16:40:37 -0400 Subject: [PATCH] Enhancement: cves/2022/CVE-2022-2633.yaml by cs --- cves/2022/CVE-2022-2633.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/cves/2022/CVE-2022-2633.yaml b/cves/2022/CVE-2022-2633.yaml index a9410e169a..e5b969f99a 100644 --- a/cves/2022/CVE-2022-2633.yaml +++ b/cves/2022/CVE-2022-2633.yaml @@ -1,17 +1,19 @@ id: CVE-2022-2633 info: - name: All-In-One Video Gallery <=2.6.0 - Arbitrary File Download/Server-Side Request Forgery + name: All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery author: theamanrawat description: | - WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server. + WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server. reference: - https://wpscan.com/vulnerability/852c257c-929a-4e4e-b85e-064f8dadd994 - https://blog.amanrawat.in/2022/09/28/CVE-2022-2633.html - https://wordpress.org/plugins/all-in-one-video-gallery/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2633 - https://nvd.nist.gov/vuln/detail/CVE-2022-2633 classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-918 cve-id: CVE-2022-2633 metadata: verified: true @@ -35,4 +37,4 @@ requests: status: - 200 -# Enhanced by md on 2023/04/07 +# Enhanced by cs on 2023/04/10