CVE-2022-4031lowCWE-22

CVE-2022-4031: fallo de gravedad baja en simplepress Simple:Press Forum

Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Simple:Press Forum

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.8epss 0.8%
The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Productos afectados
simplepress · Simple:Press Forum
CVEs relacionadas — simplepress Simple:Press Forum

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-36706CRITICALSimple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File UploadEPSS 2.2%CVE-2022-4030HIGHSimple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File DeletionEPSS 1.7%CVE-2022-4027HIGHSimple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum RepliesEPSS 0.6%CVE-2022-4029MEDIUMSimple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie ValueEPSS 0.6%CVE-2022-4028MEDIUMSimple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile SignaturesEPSS 0.6%CVE-2024-12409MEDIUMSimple:Press Forum <= 6.10.11 - Reflected Cross-Site ScriptingEPSS 0.4%