CVE-2022-3590

WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami wordpress-multisite

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"},{"introduced":"4.2.0"},{"fixed":"6.1.2"}]}]

Bitnami wordpress

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"},{"introduced":"4.2.0"},{"fixed":"6.1.2"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-3590 wordpress
Ubuntu UBUNTU-CVE-2022-3590 wordpress

Références

advisory blog.sonarsource.com
advisory wpscan.com
web nvd.nist.gov