CVE-2022-2633

Katalog CVE

CVSS 8.2 · High EPSS 33,8%

Kerentanan Externally Controlled Reference to a Resource in Another Sphere pada plugins360 all-in-one video gallery. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.

Rincian

Terbit di NVD

6 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

33,8% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227 patch · advisory pihak ketiga
• https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php patch · advisory pihak ketiga
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2744708%40all-in-one-video-ga... patch · advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633 advisory pihak ketiga
• https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve