CVE-2022-3568
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
概要
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web plugins.trac.wordpress.org
- web wordfence.com
- web wordfence.com