CVE-2022-3124

MEDIUMNuclei

Frontend File Manager < 21.3 - Unauthenticated File Renaming

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3124 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 7, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Frontend File Manager Plugin

CVE List21.3 to < 21.3affected

frontend_file_manager

Browse najeebmedia / frontend_file_manager
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMFrontend File Manager < 21.3 - Unauthenticated File RenamingCVSS 5.3

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

Impact

Unauthenticated attackers can rename uploaded files and manipulate arbitrary file content on the web server through path traversal, potentially overwriting critical WordPress files or injecting malicious code.

Remediation

Update Frontend File Manager plugin to version 21.3 or later that validates file rename operations and restricts them to authenticated users with proper path validation.

WeaknessesCWE-862
Authorsriteshs4hu
Template tagscvecve2022wordpresswp-pluginwpscannmedia-user-file-uploaderfile-uploadintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CPE: cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:*
https://nvd.nist.gov/vuln/detail/CVE-2022-3124 https://wpscan.com/vulnerability/00f76765-95af-4dbc-8c37-f1b15a0e8608/

Source: ProjectDiscovery

References

2