PT-2022-19570 · WordPress · Wp Cerber Security

Margaux Dabert · Published 2022-09-06 · Updated 2022-09-13 · CVE-2022-2939

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Cerber Security plugin for WordPress versions up to, and including 9.0

Description The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass, making user enumeration possible. This is due to improper validation on the value supplied through the author parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can be targeted in further attacks.

Recommendations For WP Cerber Security plugin for WordPress versions up to, and including 9.0, update to a version that includes the fix for this issue to prevent user enumeration. As a temporary workaround, consider restricting access to the ~/cerber-load.php file or modifying the validation logic for the author parameter to prevent bypassing the security protection.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-2939

Affected Products

Wp Cerber Security

References · 5

• https://osv.dev/vulnerability/CVE-2022-2939 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2772930/wp-cerber/trunk/cerber-load.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2939 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2939 · Note
• https://t.me/cibsecurity/49364 · Telegram Post