Lucene search

WPScanCVE-2022-3989

HistoryDec 12, 2022 - 6:15 p.m.

CVE-2022-3989

2022-12-1218:15:12

WPScan

web.nvd.nist.gov

cve-2022-3989

motors wordpress plugin

security vulnerability

file upload validation

ajax action

php file

brute-force attack

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim’s WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.

Affected configurations

Nvd

Vulners

Node

stylemixthemesmotors_-_car_dealer\,_classifieds_\&_listingRange<1.4.4wordpress

VendorProductVersionCPE
stylemixthemesmotors_-_car_dealer\,_classifieds_\&_listing*cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
stylemixthemes	motors_-_car_dealer\,_classifieds_\&_listing	*	cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Motors",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.4.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca32091

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

Related for CVE-2022-3989