CVE-2022-21663mediumCWE-74

CVE-2022-21663: fallo de gravedad media en wordpress-develop

Authenticated Object Injection in Multisites in WordPress

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear wordpress-develop+ Monitorear wordpress

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.6epss 3.8%
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
WordPress · wordpress-develop
CVEs relacionadas — wordpress-develop

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-21661HIGHSQL injection in WordPressEPSS 97.8%CVE-2021-29447HIGHWordPress Authenticated XXE attack when installation is running PHP 8EPSS 85.7%CVE-2022-21662HIGHStored XSS in WordPressEPSS 64.5%CVE-2022-21664HIGHSQL injection in WordPressEPSS 3.7%CVE-2020-4047MEDIUMAuthenticated XSS via media attachment page in WordPressEPSS 3.3%CVE-2024-31211MEDIUMRemote Code Execution in `WP_HTML_Token`EPSS 2.7%