gsd-2022-2633
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
Aliases
Aliases
CVE-2022-2633


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-2633",
    "description": "The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the \u0027dl\u0027 parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.",
    "id": "GSD-2022-2633"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-2633"
      ],
      "details": "The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the \u0027dl\u0027 parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.",
      "id": "GSD-2022-2633",
      "modified": "2023-12-13T01:19:19.926017Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@wordfence.com",
        "ID": "CVE-2022-2633",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "All-in-One Video Gallery",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "2.5.8",
                          "version_value": "2.6.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "plugins360"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Gabriele Zuddas"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the \u0027dl\u0027 parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve",
            "refsource": "MISC",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve"
          },
          {
            "name": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227",
            "refsource": "MISC",
            "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227"
          },
          {
            "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2744708%40all-in-one-video-gallery\u0026new=2744708%40all-in-one-video-gallery\u0026sfp_email=\u0026sfph_mail=",
            "refsource": "MISC",
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2744708%40all-in-one-video-gallery\u0026new=2744708%40all-in-one-video-gallery\u0026sfp_email=\u0026sfph_mail="
          },
          {
            "name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633",
            "refsource": "MISC",
            "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633"
          },
          {
            "name": "https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php",
            "refsource": "MISC",
            "url": "https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*",
                    "matchCriteriaId": "366D1EF1-5A0A-47E6-9DB1-8F5D69FB8172",
                    "versionEndIncluding": "2.6.0",
                    "versionStartIncluding": "2.5.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the \u0027dl\u0027 parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server."
          },
          {
            "lang": "es",
            "value": "El plugin All-in-One Video Gallery para WordPress es vulnerable a la descarga de archivos arbitrarios y un ataque de tipo server-side request forgery ciego por medio del par\u00e1metro \"dl\" que es encontrado en el archivo ~/public/video.php en versiones hasta 2.6.0 incluy\u00e9ndola. Esto hace posible a usuarios no autenticados descargar archivos confidenciales alojados en el servidor afectado y falsifiquen peticiones al servidor."
          }
        ],
        "id": "CVE-2022-2633",
        "lastModified": "2024-01-11T09:15:45.340",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security@wordfence.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2022-09-06T18:15:14.503",
        "references": [
          {
            "source": "security@wordfence.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227"
          },
          {
            "source": "security@wordfence.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php"
          },
          {
            "source": "security@wordfence.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2744708%40all-in-one-video-gallery\u0026new=2744708%40all-in-one-video-gallery\u0026sfp_email=\u0026sfph_mail="
          },
          {
            "source": "security@wordfence.com",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve"
          },
          {
            "source": "security@wordfence.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633"
          }
        ],
        "sourceIdentifier": "security@wordfence.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-610"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.