Lucene search

WPScanCVE-2022-0863

HistoryJun 13, 2022 - 1:15 p.m.

CVE-2022-0863

2022-06-1313:15:10

CWE-434

WPScan

web.nvd.nist.gov

cve-2022-0863

wp svg icons

wordpress

plugin

vulnerability

remote code execution

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.7%

JSON

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.

Affected configurations

Nvd

Vulners

Node

wp_svg_icons_projectwp_svg_iconsRange≤3.2.3wordpress

VendorProductVersionCPE
wp_svg_icons_projectwp_svg_icons*cpe:2.3:a:wp_svg_icons_project:wp_svg_icons:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wp_svg_icons_project	wp_svg_icons	*	cpe:2.3:a:wp_svg_icons_project:wp_svg_icons::::::wordpress::*

CNA Affected

[
  {
    "product": "WP SVG Icons",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "3.2.3",
        "status": "affected",
        "version": "3.2.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.7%

JSON

Related for CVE-2022-0863