CVE-2022-1398 External Media without Import <= 1.1.2 - Subscriber+ Blind SSRF
Authenticated users can perform blind SSRF attacks due to missing authorization and validation in the External Media without Import plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1398?
CVE-2022-1398 is a medium-severity server-side request forgery vulnerability in Unknown External Media without Import, published on 16 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
Weakness: CWE-918
Which versions are affected by CVE-2022-1398?
It affects 1 product.
Products include External Media Without Import Project External Media Without Import.
How do I fix CVE-2022-1398?
No fix has been published for CVE-2022-1398 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-1398 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1398 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown External Media without Import
Sources
Also known as GHSA-r929-j7c3-45vr.