PT-2023-15913 · Unknown · Udx Stateless Media Plugin

Published 2023-02-13 · Updated 2024-05-17 · CVE-2022-4905

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UDX Stateless Media Plugin version 3.1.1

Description A vulnerability was found in the UDX Stateless Media Plugin. It affects the setup wizard interface function of the file lib/classes/class-settings.php. The manipulation of the settings argument leads to cross-site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 addresses this issue.

Recommendations For UDX Stateless Media Plugin version 3.1.1, upgrade to version 3.2.0 to address the issue. As a temporary workaround, consider restricting access to the setup wizard interface function until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4905

GHSA-9J2P-8QQF-H55C

Affected Products

Udx Stateless Media Plugin

References · 10

• https://github.com/udx/wp-stateless/releases/tag/3.2.0 · Patch
• https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a · Patch
• https://github.com/udx/wp-stateless/pull/630 · Patch
• https://osv.dev/vulnerability/GHSA-9j2p-8qqf-h55c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4905 · Security Note
• https://github.com/udx/wp-stateless · Note
• https://vuldb.com/?ctiid.220750 · Note
• https://t.me/cibsecurity/58040 · Telegram Post
• https://vuldb.com/?id.220750 · Note