PT-2022-14027 · Unknown · Jupiterx Core Plugin+1

Ramuel Gall · Published 2022-05-19 · Updated 2023-06-27 · CVE-2022-1656

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JupiterX Theme versions <=2.0.6 JupiterX Core Plugin versions <=2.0.6

Description The issue allows any logged-in user to access functions registered in "lib/api/api/ajax.php", including jupiterx api ajax actions. This grants the ability to deactivate arbitrary plugins and update the theme's API key.

Recommendations For JupiterX Theme versions <=2.0.6, update to a version greater than 2.0.6 to resolve the issue. For JupiterX Core Plugin versions <=2.0.6, update to a version greater than 2.0.6 to resolve the issue. As a temporary workaround, consider restricting access to the "lib/api/api/ajax.php" file until a patch is available. Restrict access to the jupiterx api ajax actions to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-1656

Affected Products

Jupiterx Core Plugin

Jupiter Theme

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-1656 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1656 · Vendor Advisory
• https://t.me/true_secator/2959 · Telegram Post
• https://wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes · Note