PT-2023-14142 · WordPress · Replyable

Lana Codes · Published 2023-03-06 · Updated 2023-03-11 · CVE-2022-4265

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Replyable WordPress plugin versions prior to 2.2.10

Description The issue arises from the lack of validation of the class name submitted by the request when instantiating an object in the prompt dismiss notice action, and the absence of a CSRF check in the related action. This could allow any authenticated users, such as subscribers, to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user.

Recommendations For versions prior to 2.2.10, update to version 2.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the prompt dismiss notice action to minimize the risk of exploitation. Additionally, restrict the instantiation of objects based on user-submitted class names until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-4265

Affected Products

Replyable

References · 6

• 🔥 https://wpscan.com/vulnerability/095cba08-7edd-41fb-9776-da151c0885dd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4265 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4265 · Vendor Advisory
• https://t.me/cvenotify/46036 · Telegram Post
• https://t.me/cibsecurity/59478 · Telegram Post
• https://t.me/cvenotify/45610 · Telegram Post