CVE-2022-3590

5.9

MEDIUMCVSS v3

Published

December 14, 2022

Affected

4 projects

Assigned by

[email protected]

Severity scale

010

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

WordPress/WordPress

GitHubWordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.

>= 4.2, <= 6.1.1, = 4.1NVD

auth0/wordpress

GitHubWordPress Plugin for Auth0 Authentication

>= 4.2, <= 6.1.1, = 4.1NVD

wordpress

More on this CVE

NVD↗GitHub Advisory↗

NPMA client for working with WordPress.

>= 4.2, <= 6.1.1, = 4.1NVD

wordpress

RubyGemsThe Wordpress gem provides posting to a Wordpress.com blog or a self hosted wordpress by providing your username, password, login url(if you host your blog) and your blog content. With this gem, you have access to add a text entry on Wordpress blog by providing these options: title text, body text, and a tag array. You must include at least title text or body text with your post. Posting images with posts, posting only images and pulling down your posts will be available very soon.

>= 4.2, <= 6.1.1, = 4.1NVD

Security Advisories

CVE-2022-3590

Description

More on this CVE