PT-2022-25983 · Unknown · Bp Better Messages

Ananda Dhakal + 1 · Published 2022-11-18 · Updated 2022-11-21 · CVE-2022-41609

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Better Messages plugin version 1.9.10.68

Description The issue is related to an Authenticated Server-Side Request Forgery (SSRF) vulnerability. This means that an attacker could potentially forge requests to internal or external services, but only if they have authenticated access to the system as a subscriber or higher.

Recommendations For Better Messages plugin version 1.9.10.68, update to a newer version that contains a fix for this issue, if available. As a temporary workaround, consider restricting access to sensitive internal services to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-41609

Affected Products

Bp Better Messages

References · 4

• https://osv.dev/vulnerability/CVE-2022-41609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41609 · Security Note
• https://wordpress.org/plugins/bp-better-messages/#developers · Note
• https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-68-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note