CVE-2022-2594

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2	Exploit Third Party Advisory
https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-files	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:advancedcustomfields:advanced_custom_fields::::::wordpress::*
	cpe:2.3:a:advancedcustomfields:advanced_custom_fields:::::pro:wordpress::

History

No history.

Information

Published : 2022-08-22 15:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-2594

Mitre link : CVE-2022-2594

CVE.ORG link : CVE-2022-2594

JSON object : View

Products Affected

advancedcustomfields

advanced_custom_fields

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2022-2594", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-08-22T15:15:15.653", "references": [{"url": "https://wpscan.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://www.pritect.net/blog/advanced-custom-fields-5-12-3-can-allow-unauthenticated-users-to-upload-arbitrary-files", "tags": ["Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release."}, {"lang": "es", "value": "El plugin Advanced Custom Fields de WordPress versiones anteriores a 5.12.3, Advanced Custom Fields Pro WordPress plugin versiones anteriores a 5.12.3 permite a usuarios no autenticados subir archivos permitidos en una configuraci\u00f3n predeterminada de WP (por lo que no es posible PHP) si se presenta un formulario de frontend disponible. Esta vulnerabilidad fue introducida en la reescritura 5.0 y no exist\u00eda antes de esa versi\u00f3n."}], "lastModified": "2022-08-23T19:16:17.567", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "F0D5AD3B-BED2-4F83-925F-9C7AD34E4024", "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:pro:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "3BD06CB6-0BFC-447E-925C-7E8D6DC886EE", "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}