2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"Amelia – Events & Appointments Booking Calendar","vendor":"Unknown","versions":[{"lessThan":"1.0.47","status":"affected","version":"1.0.47","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tms-outsource:amelia:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"68626433-8C2F-452D-94CF-FB37BA2F9B70","versionEndExcluding":"1.0.47","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."},{"lang":"es","value":"El plugin Amelia de WordPress versiones anteriores a 1.0.47, almacena los blobs de imágenes en archivos reales cuya extensión es controlada por el usuario, lo que puede conllevar a una carga de backdoors PHP en el sitio. Esta vulnerabilidad puede ser explotada por usuarios conectados con el rol personalizado \"Amelia Manager\""}],"id":"CVE-2022-0687","lastModified":"2026-06-17T04:21:03.987","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-03-21T19:15:11.337","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"contact@wpscan.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-434"}],"source":"nvd@nist.gov","type":"Secondary"}]}
|