CVE-2022-1953

Katalog CVE

CVSS 9.1 · Critical EPSS 1,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada product configurator for woocommerce project product configurator for woocommerce. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first

Rincian

Terbit di NVD

27 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/b66d6682-edbc-435f-a73a-dced32a32770 exploit · advisory pihak ketiga