CVE-2022-0377
MEDIUMLearnPress <4.1.5 - Info Disclosure
Title source: llmDescription
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
Exploits (1)
exploitdb
WORKING POC
by Ceylan BOZOĞULLARINDAN · textwebappsphp
https://www.exploit-db.com/exploits/50706
References (3)
Scores
CVSS v3
4.3
EPSS
0.0303
EPSS Percentile
86.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-327
Status
published
Products (1)
thimpress/learnpress
< 4.1.5
Published
Feb 28, 2022
Tracked Since
Feb 18, 2026