8.8

CVE-2022-2594

Exploit

Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF

Advanced Custom Fields <= 5.12.2 - File Upload

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Mögliche Gegenmaßnahme
Beebee Mini: Update to version 1.3.0, or a newer patched version
Advanced Custom Fields (ACF®): Update to version 5.12.3, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Beebee Mini
Version * - 1.2.0
SystemWordPress Plugin
≫
Produkt Advanced Custom Fields (ACF®)
Version * - 5.12.2
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Advancedcustomfields ≫ Advanced Custom Fields SwPlatformwordpress Version >= 5.0.0 < 5.12.3
Advancedcustomfields ≫ Advanced Custom Fields SwEditionpro SwPlatformwordpress Version >= 5.0.0 < 5.12.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.2% 0.839
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.