CVE-2022-2442
Summary
| CVE | CVE-2022-2442 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-09-06 18:15:00 UTC |
| Updated | 2024-01-11 09:15:00 UTC |
| Description | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Wpvivid | Migration Backup Staging | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Vulnerability Advisories - Wordfence | MISC | www.wordfence.com | |
| Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization | www.wordfence.com | ||
| 403 Forbidden | MISC | plugins.trac.wordpress.org | |
| 403 Forbidden | MISC | plugins.trac.wordpress.org | |
| 403 Forbidden | MISC | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Rasoul Jahanshahi
There are currently no legacy QID mappings associated with this CVE.