8.8
CVE-2022-2441
- EPSS 1.9%
- Veröffentlicht 20.10.2023 08:15:11
- Zuletzt bearbeitet 21.11.2024 07:00:59
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
Mögliche Gegenmaßnahme
ImageMagick Engine: Update to version 1.7.6, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
ImageMagick Engine
Version
*-1.7.5
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Orangelab ≫ Imagemagick Engine SwPlatformwordpress Version <= 1.7.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.9% | 0.827 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| security@wordfence.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.