PT-2022-19620 · Unknown · Counter Box

0Xb9 + 2 · Published 2022-05-19 · Updated 2022-05-26 · CVE-2022-29446

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Counter Box plugin versions prior to 1.1.2

Description The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher role access can potentially include and execute local files on the server, which could lead to sensitive data exposure or code execution.

Recommendations For versions prior to 1.1.2, update to version 1.1.2 or later to resolve the issue.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-29446

Affected Products

Counter Box

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-29446 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29446 · Vendor Advisory
• https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-local-file-inclusion-lfi-vulnerability · Note
• https://wordpress.org/plugins/counter-box/#developers · Note