CVE-2022-0779 User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
Low-privileged users can enumerate local files on the web server via path traversal in the User Meta WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0779?
CVE-2022-0779 is a medium-severity path traversal vulnerability in Unknown User Meta – User Profile Builder and User management plugin, published on 6 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
Weakness: CWE-22
Which versions are affected by CVE-2022-0779?
It affects 1 product.
Products include User-Meta User Meta User Profile Builder and User Management.
How do I fix CVE-2022-0779?
No fix has been published for CVE-2022-0779 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-0779 being exploited?
There is no known exploitation of CVE-2022-0779 in the wild and no public exploit code.
Other vulnerabilities in Unknown User Meta – User Profile Builder and User management plugin
Sources
Also known as GHSA-g3g8-hxhq-mfvr.