CVE-2022-45362

HIGHNuclei

WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-45362 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Paytm Payment Gateway

Browse Paytm / Paytm Payment Gatewaypaytm-payments

Default status: unaffected

CVE ListThrough 2.7.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request ForgeryCVSS 6.5

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can exploit server-side request forgery through the url parameter in the curltest action to make arbitrary HTTP requests from the server, potentially accessing internal network resources and sensitive data.

Remediation

Update to the latest version of the WordPress Paytm Payment Gateway plugin (2.7.0) or apply the vendor-supplied patch.

WeaknessesCWE-918
Authorstheamanrawat
Template tagscvecve2022ssrfwordpresswp-pluginwppaytm-paymentsunauthoastpaytmvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:paytm:payment_gateway:*:*:*:*:*:wordpress:*:*
https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability https://wordpress.org/plugins/paytm-payments/ https://nvd.nist.gov/vuln/detail/CVE-2022-45362 https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2