CVE-2022-1390

Katalog CVE

CVSS 9.8 · Critical EPSS 21,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada admin word count column project admin word count column. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique

Rincian

Terbit di NVD

25 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

21,9% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://packetstormsecurity.com/files/166476/ exploit · advisory pihak ketiga · vdb entry
• https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990 exploit · advisory pihak ketiga