8.8

CVE-2022-2594

Exploit

Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload

Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF

Advanced Custom Fields <= 5.12.2 - File Upload

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Mögliche Gegenmaßnahme
Beebee Mini: Update to version 1.3.0, or a newer patched version
Advanced Custom Fields (ACF®): Update to version 5.12.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Advancedcustomfields ≫ Advanced Custom Fields SwPlatformwordpress Version >= 5.0.0 < 5.12.3
Advancedcustomfields ≫ Advanced Custom Fields SwEditionpro SwPlatformwordpress Version >= 5.0.0 < 5.12.3
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Beebee Mini
Version *-1.2.0
SystemWordPress Plugin
≫
Produkt Advanced Custom Fields (ACF®)
Version *-5.12.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.26% 0.659
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2
Third Party Advisory
Exploit
https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-files
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/27ca0d04-9796-415f-a6e6-7c1752a74fea
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e5bab390-1590-44f2-8c65-bc329955ed84
Third Party Advisory