CVE-2022-2943

The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9	Exploit Third Party Advisory
https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=cve	Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2943	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2022-09-06 18:15

Updated : 2023-11-07 03:47

NVD link : CVE-2022-2943

Mitre link : CVE-2022-2943

CVE.ORG link : CVE-2022-2943

JSON object : View

Products Affected

connekthq

ajax_load_more

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-2943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2022-09-06T18:15:15.267", "references": [{"url": "https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt", "tags": ["Release Notes"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2943", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The WordPress Infinite Scroll \u2013 Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file."}, {"lang": "es", "value": "El plugin WordPress Infinite Scroll - Ajax Load More para Wordpress es vulnerable a una lectura de archivos arbitrarios en versiones hasta 5.5.3, incluy\u00e9ndola, debido a una insuficiente comprobaci\u00f3n de la ruta del archivo en la funci\u00f3n alm_repeaters_export(). Esto hace posible a atacantes autenticados, con privilegios administrativos, descargar archivos arbitrarios alojados en el servidor que pueden contener contenido confidencial, como el archivo wp-config.php.\n"}], "lastModified": "2023-11-07T03:47:06.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "506CF2A6-A4C6-4243-A655-96694C37296D", "versionEndExcluding": "5.5.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}