CVE-2022-1560 Amministrazione Aperta < 3.8 - Admin+ LFI
An attacker can exploit a Local File Inclusion vulnerability in the Amministrazione Aperta plugin to read arbitrary files or execute code via admin interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1560?
CVE-2022-1560 is a medium-severity path traversal vulnerability in Unknown Amministrazione Aperta, published on 16 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
Weakness: CWE-22
Which versions are affected by CVE-2022-1560?
It affects 1 product.
Products include Amministrazione Aperta Project Amministrazione Aperta.
How do I fix CVE-2022-1560?
No fix has been published for CVE-2022-1560 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-1560 being exploited?
There is no known exploitation of CVE-2022-1560 in the wild and no public exploit code.
Sources
Also known as GHSA-x2w2-jcc3-34qr.