PT-2023-15913 · Unknown · Udx Stateless Media Plugin

CVE-2022-4905 · Published 2023-02-13 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UDX Stateless Media Plugin version 3.1.1

Description A vulnerability was found in the UDX Stateless Media Plugin. It affects the setup wizard interface function of the file lib/classes/class-settings.php. The manipulation of the settings argument leads to cross-site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 addresses this issue.

Recommendations For UDX Stateless Media Plugin version 3.1.1, upgrade to version 3.2.0 to address the issue. As a temporary workaround, consider restricting access to the setup wizard interface function until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4905

GHSA-9J2P-8QQF-H55C

Affected Products

Udx Stateless Media Plugin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4905.json · Exploit
• https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a · Patch
• https://github.com/udx/wp-stateless/pull/630 · Patch
• https://github.com/udx/wp-stateless/releases/tag/3.2.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4905 · Security Note
• https://osv.dev/vulnerability/GHSA-9j2p-8qqf-h55c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4905 · Vendor Advisory
• https://github.com/udx/wp-stateless · Note
• https://vuldb.com/?id.220750 · Note
• https://vuldb.com/?ctiid.220750 · Note
• https://t.me/cibsecurity/58040 · Telegram Post