PT-2022-26039 · WordPress · Demon Image Annotation Plugin

Ori Gabriel · Published 2022-12-13 · Updated 2022-12-16 · CVE-2022-4171

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions demon image annotation plugin for WordPress versions up to, and including 5.0

Description The issue arises from improper input validation in the plugin, specifically when handling the number of characters supplied during an annotation. Despite having a setting to limit the number of characters input, the plugin fails to properly validate this, allowing unauthenticated attackers to bypass the length restrictions and input more characters than allowed via the settings.

Recommendations For demon image annotation plugin for WordPress versions up to, and including 5.0, consider disabling the annotation feature until a patch is available to prevent exploitation. Restrict access to the plugin's settings to minimize the risk of attackers modifying the input validation settings. Avoid using the plugin for sensitive annotations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2022-4171

Affected Products

Demon Image Annotation Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2022-4171 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830349%40demon-image-annotation&new=2830349%40demon-image-annotation&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4171 · Security Note
• https://t.me/cibsecurity/54474 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ac5549ec-f931-4b13-b5f9-0d6f3e53aae4 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ac5549ec-f931-4b13-b5f9-0d6f3e53aae4?source=cve · Note