2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus","vendor":"Unknown","versions":[{"lessThan":"2.5.2","status":"affected","version":"2.5.2","versionType":"custom"}]},{"product":"PublishPress Capabilities Pro","vendor":"Unknown","versions":[{"lessThan":"2.5.2","status":"affected","version":"2.5.2","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:*","matchCriteriaId":"0F084949-93A1-454E-ABD3-CEAB95C45C99","versionEndExcluding":"2.5.2","vulnerable":true},{"criteria":"cpe:2.3:a:publishpress:capabilities:*:*:*:*:pro:wordpress:*:*","matchCriteriaId":"ECB8ACB5-61D0-4518-A7E6-3E68F3FE4B1C","versionEndExcluding":"2.5.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site."},{"lang":"es","value":"El complemento PublishPress Capabilities WordPress anterior a 2.5.2, el complemento PublishPress Capabilities Pro WordPress anterior a 2.5.2 deserializa el contenido de los archivos importados, lo que podría provocar ataques de inyección de objetos PHP por parte de los administradores, en configuraciones de WordPress multisitio. En este caso, una explotación exitosa requiere que otros complementos con una cadena de gadgets adecuada estén presentes en el sitio."}],"id":"CVE-2022-3366","lastModified":"2026-06-17T04:59:23.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-3366","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-06T20:26:42.467732Z","version":"2.0.3"}}]},"published":"2022-10-31T16:15:11.330","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"contact@wpscan.com","type":"Secondary"}]}
|