PT-2022-14030 · Unknown · Jupiter X Core

Ramuel Gall · Published 2022-05-19 · Updated 2022-06-21 · CVE-2022-1659

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JupiterX Core versions <= 2.0.6

Description The issue allows an attacker to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub action parameter through the AJAX action jupiterx conditional manager. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.

Recommendations For versions <= 2.0.6, update to a version greater than 2.0.6 to resolve the issue. As a temporary workaround, consider restricting access to the jupiterx conditional manager AJAX action to minimize the risk of exploitation. Avoid using the sub action parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-1659

Affected Products

Jupiter X Core

References · 5

• 🔥 https://wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1659 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1659 · Vendor Advisory
• https://t.me/cibsecurity/44304 · Telegram Post
• https://t.me/true_secator/2959 · Telegram Post