CVE-2022-2180

🗓️ 15 Aug 2022 08:36:24Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 78 Views🌐 WEB

The GREYD.SUITE WordPress theme allows unauthenticated remote code execution via unauthorized font package uploads

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-2180	15 Aug 202211:21	–	attackerkb
CNNVD	WordPress theme GREYD.SUITE 代码问题漏洞	15 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2180 GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE	15 Aug 202208:36	–	cvelist
EUVD	EUVD-2022-34464	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2180	15 Aug 202211:21	–	nvd
OSV	CVE-2022-2180	15 Aug 202211:21	–	osv
Patchstack	WordPress GREYD.SUITE theme <= 1.2.6.1 - Unauthenticated File Upload vulnerability leading to Remote Code Execution (RCE)	21 Jul 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	15 Aug 202211:21	–	prion
Positive Technologies	PT-2022-15138 · WordPress · Greyd.Suite	15 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2180	22 May 202523:44	–	redhatcve

NVD

Vulners

Node

greyd greyd.suiteRange<1.2.7wordpress

[
  {
    "product": "greyd_suite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.2.7",
        "status": "affected",
        "version": "1.2.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1

Parameter	Position	Path	Description	CWE
mode	request body	wp-content/themes/greyd_suite/inc/customizer_ff.php	Unauthenticated upload of arbitrary files via form-based ZIP upload leading to possible remote code execution (RCE).	CWE-434
uploadpath	request body	wp-content/themes/greyd_suite/inc/customizer_ff.php	Unauthenticated upload of arbitrary files via form-based ZIP upload leading to possible remote code execution (RCE).	CWE-434
name_full	request body	wp-content/themes/greyd_suite/inc/customizer_ff.php	Unauthenticated upload of arbitrary files via form-based ZIP upload leading to possible remote code execution (RCE).	CWE-434
file	request body	wp-content/themes/greyd_suite/inc/customizer_ff.php	Unauthenticated upload of arbitrary files via form-based ZIP upload leading to possible remote code execution (RCE).	CWE-434