CVE-2022-1560

Katalog CVE

CVSS 6.5 · Medium EPSS 2,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada amministrazione aperta project amministrazione aperta. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link

Rincian

Terbit di NVD

16 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/5c5fbbea-92d2-46bb-9a70-75155fffb6de exploit · advisory pihak ketiga