Vulnerability Details : CVE-2022-2633
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2022-2633
- Plugins360 » All-in-one Video Gallery » For WordpressVersions from including (>=) 2.5.8 and up to, including, (<=) 2.6.0cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-2633
88.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-2633
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
3.9
|
4.2
|
NIST | |
|
8.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
3.9
|
4.2
|
Wordfence | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
Wordfence | 2024-01-11 |
CWE ids for CVE-2022-2633
-
The product allows user input to control or influence paths or file names that are used in filesystem operations.Assigned by: security@wordfence.com (Secondary)
-
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.Assigned by: nvd@nist.gov (Primary)
-
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.Assigned by: security@wordfence.com (Secondary)
References for CVE-2022-2633
-
https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php
Changeset 2768384 for all-in-one-video-gallery/trunk/public/video.php – WordPress Plugin RepositoryPatch;Third Party Advisory
-
https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve
All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery
-
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633
Vulnerability Advisories - WordfenceThird Party Advisory
-
https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227
video.php in all-in-one-video-gallery/trunk/public – WordPress Plugin RepositoryPatch;Third Party Advisory
-
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2744708%40all-in-one-video-gallery&new=2744708%40all-in-one-video-gallery&sfp_email=&sfph_mail=
Changeset 2744708 for all-in-one-video-gallery – WordPress Plugin RepositoryPatch;Third Party Advisory
Jump to