2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"product":"CM Download Manager","vendor":"Unknown","versions":[{"lessThan":"2.8.6","status":"affected","version":"2.8.6","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cminds:cm_download_manager:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"E3B2416C-5A22-44E8-9B07-D3D4A498F11E","versionEndExcluding":"2.8.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example."},{"lang":"es","value":"El plugin CM Download Manager de WordPress versiones anteriores a 2.8.6, permite a usuarios con altos privilegios, como los administradores, subir archivos arbitrarios estableciendo cualquier extensión por medio de la configuración del plugin, lo que podría ser usado por los administradores de un blog multisitio para descargar archivos PHP, por ejemplo.\n"}],"id":"CVE-2022-3076","lastModified":"2026-06-17T04:58:46.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-3076","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-22T15:40:45.891130Z","version":"2.0.3"}}]},"published":"2022-09-26T13:15:11.090","references":[{"source":"contact@wpscan.com","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"contact@wpscan.com","type":"Secondary"}]}
|