PT-2022-16638 · WordPress · Download Manager

Rasoul Jahanshahi · Published 2022-09-06 · Updated 2023-10-24 · CVE-2022-2436

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to and including 3.2.49

Description The issue allows authenticated attackers with contributor privileges and above to deserialize untrusted input via the file[package dir] parameter. This can lead to the execution of arbitrary PHP objects, enabling various malicious actions if a POP chain is present. The attack requires the successful upload of a file containing a serialized payload.

Recommendations For Download Manager plugin for WordPress versions up to and including 3.2.49, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the file[package dir] parameter to minimize the risk of exploitation. Avoid using the file[package dir] parameter in the affected plugin until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-2436

Affected Products

Download Manager

References · 6

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php&new=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2436 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2436 · Vendor Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2436 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=cve · Note
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L68 · Note