PT-2023-15913 · Unknown · Udx Stateless Media Plugin

CVE-2022-4905 · Publicado 2023-02-13 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UDX Stateless Media Plugin version 3.1.1

Description A vulnerability was found in the UDX Stateless Media Plugin. It affects the setup wizard interface function of the file lib/classes/class-settings.php. The manipulation of the settings argument leads to cross-site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 addresses this issue.

Recommendations For UDX Stateless Media Plugin version 3.1.1, upgrade to version 3.2.0 to address the issue. As a temporary workaround, consider restricting access to the setup wizard interface function until the upgrade is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-4905

GHSA-9J2P-8QQF-H55C

Produtos afetados

Udx Stateless Media Plugin

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4905.json · Exploit
• https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a · Correção
• https://github.com/udx/wp-stateless/pull/630 · Correção
• https://github.com/udx/wp-stateless/releases/tag/3.2.0 · Correção
• https://github.com/udx/wp-stateless · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4905 · Nota de Segurança
• https://vuldb.com/?id.220750 · Nota
• https://vuldb.com/?ctiid.220750 · Nota
• https://t.me/cibsecurity/58040 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-9j2p-8qqf-h55c · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-4905 · Aviso do Fabricante