PT-2022-13653 · WordPress · Safe-Svg

David Hamann · Published 2022-04-18 · Updated 2022-04-27 · CVE-2022-1091

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Safe SVG WordPress plugin versions prior to 1.9.10

Description The sanitisation step of the Safe SVG WordPress plugin can be bypassed by spoofing the content-type in the POST request to upload a file, allowing an attacker to perform attacks that the plugin should prevent, mainly XSS, but potentially other XML attacks depending on further use of uploaded SVG files.

Recommendations For versions prior to 1.9.10, update to version 1.9.10 or later to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files or disabling the plugin until a patch is available. Avoid using the vulnerable plugin to upload SVG files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1091

GHSA-5H7W-HMXC-99G5

Affected Products

Safe-Svg

References · 9

• 🔥 https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3 · Exploit
• https://github.com/10up/safe-svg/pull/28 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1091 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1091 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h7w-hmxc-99g5 · Vendor Advisory
• https://github.com/10up/safe-svg/commit/00cb9a86d1bff2214714557d1901ec3896564e50 · Note
• https://github.com/10up/safe-svg · Note
• https://t.me/cibsecurity/41055 · Telegram Post
• https://t.me/cvenotify/29379 · Telegram Post