Lucene search

WordfenceCVE-2022-1209

HistoryMay 10, 2022 - 8:15 p.m.

CVE-2022-1209

2022-05-1020:15:08

Wordfence

web.nvd.nist.gov

wordpress

ultimate member

plugin

open redirect

vulnerability

nvd

cve-2022-1209

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

60.5%

JSON

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.

Affected configurations

Nvd

Vulners

Node

ultimatememberultimate_memberRange≤2.3.1wordpress

VendorProductVersionCPE
ultimatememberultimate_member*cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ultimatemember	ultimate_member	*	cpe:2.3:a:ultimatemember:ultimate_member::::::wordpress::*

CNA Affected

[
  {
    "vendor": "ultimatemember",
    "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md

github.com/ultimatemember/ultimatemember/issues/989

github.com/ultimatemember/ultimatemember/pull/990

www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve

www.wordfence.com/vulnerability-advisories/#CVE-2022-1209

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

60.5%

JSON

Related for CVE-2022-1209