CVE-2022-2441

Katalog CVE

CVSS 8.8 · High EPSS 1,1%

Kerentanan Cross-Site Request Forgery (CSRF) pada orangelab imagemagick engine. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.

Rincian

Terbit di NVD

20 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529 patch
• https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529 patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2801283%40imagemagick-engine%... patch
• https://www.exploit-db.com/exploits/51025 exploit · advisory pihak ketiga · vdb entry
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=cve advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2441 advisory pihak ketiga