CVE-2022-2711

{"id": "CVE-2022-2711", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-11-07T10:15:11.480", "references": [{"url": "https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector."}, {"lang": "es", "value": "El complemento Importar cualquier archivo XML o CSV a WordPress anterior a 3.6.9 no valida las rutas de los archivos contenidos en los archivos zip cargados, lo que permite a usuarios con privilegios elevados, como administradores, escribir archivos arbitrarios en cualquier parte del sistema de archivos al que pueda acceder el servidor web a trav\u00e9s de un vector de path traversal."}], "lastModified": "2022-11-09T20:04:59.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "AC5FEDCB-4B80-44FE-9AE2-60C4CA4DB7CE", "versionEndExcluding": "3.6.9"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}