CVE-2019-16932

CRITICALNuclei

themeisle visualizer Server-Side Request Forgery (SSRF)

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-16932 has a selected CVSS score of 10.0 (critical); EIP currently links 1 Nuclei template.

Description

A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 11, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

visualizer

Browse themeisle / visualizer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALVisualizer <3.3.1 - Blind Server-Side Request ForgeryCVSS 10

Visualizer prior to 3.3.1 suffers from a blind server-side request forgery vulnerability via the /wp-json/visualizer/v1/upload-data endpoint.

Impact

An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or data leakage.

Remediation

Update Visualizer plugin to version 3.3.1 or later to fix the SSRF vulnerability.

WeaknessesCWE-918
Authorsakincibor
Template tagscvecve2019wp-pluginssrfwordpressoastunauthwpscanintrusivethemeislexssvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CPE: cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/9892 https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf https://nvd.nist.gov/vuln/detail/CVE-2019-16932 https://wordpress.org/plugins/visualizer/#developers https://wpvulndb.com/vulnerabilities/9892

Source: ProjectDiscovery

References

4