CVE-2022-2441
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution
概要
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory wordfence.com
- web github.com
- web github.com
- web plugins.trac.wordpress.org
- web exploit-db.com
- web wordfence.com