PT-2022-23794 · WordPress · Web Stories

Aymen Borgi · Published 2022-10-28 · Updated 2025-05-05 · CVE-2022-3708

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Web Stories plugin for WordPress versions up to, and including 1.24.0

Description The issue arises from insufficient validation of URLs supplied via the url parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated users to make web requests to arbitrary locations, potentially querying and modifying information from internal services.

Recommendations For versions up to, and including 1.24.0, update to a version later than 1.24.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/v1/hotlink/proxy" REST API Endpoint to minimize the risk of exploitation. Avoid using the url parameter in the affected API endpoint until the issue is resolved.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-3708

Affected Products

Web Stories

References · 9

• https://github.com/GoogleForCreators/web-stories-wp/commit/3ad2099f95155d658624ffac2e34ce0da739e34b · Patch
• https://github.com/GoogleForCreators/web-stories-wp/compare/v1.24.0...v1.25.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3708 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3708 · Vendor Advisory
• https://t.me/cibsecurity/52248 · Telegram Post
• https://t.me/cvenotify/120782 · Telegram Post
• https://wordpress.org/plugins/web-stories · Note
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-3708 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=cve · Note