Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2022-3590HistoryDec 14, 2022 - 9:15 a.m.
CVE-2022-3590
2022-12-1409:15:09
Debian Security Bug Tracker
security-tracker.debian.org
92
wordpress
ssrf
toctou
race condition
security vulnerability
pingback
http request
validation
unauthenticated
internal hosts
forbidden
cve-2022-3590
unix
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
50.7%
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | wordpress | <= 6.1.6+dfsg1-0+deb12u1 | wordpress_6.1.6+dfsg1-0+deb12u1_all.deb |
| Debian | 11 | all | wordpress | <= 5.7.11+dfsg1-0+deb11u1 | wordpress_5.7.11+dfsg1-0+deb11u1_all.deb |
| Debian | 999 | all | wordpress | <= 6.6.1+dfsg1-1 | wordpress_6.6.1+dfsg1-1_all.deb |
| Debian | 13 | all | wordpress | <= 6.6.1+dfsg1-1 | wordpress_6.6.1+dfsg1-1_all.deb |
Related
wpvulndb
wpvulndb
WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding
2022-12-13 00:00:00
ubuntucve
ubuntucve
CVE-2022-3590
2022-12-14 00:00:00
osv
osv
CVE-2022-3590
2022-12-14 09:15:09
BIT-wordpress-2022-3590
2024-03-06 11:09:54
BIT-wordpress-multisite-2022-3590
2024-03-06 11:09:38
cvelist
cvelist
CVE-2022-3590 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
2022-12-14 08:33:40
prion
prion
Race condition
2022-12-14 09:15:00
cve
cve
CVE-2022-3590
2022-12-14 09:15:09
openvas
openvas
WordPress <= 6.4.1 SSRF Vulnerability
2022-12-15 00:00:00
nvd
nvd
CVE-2022-3590
2022-12-14 09:15:09
wpexploit
wpexploit
WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding
2022-12-13 00:00:00
githubexploit
githubexploit
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Wordpress
2024-08-08 03:02:05
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Wordpress
2023-06-12 13:06:54
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
50.7%
Related for DEBIANCVE:CVE-2022-3590