CVE-2022-1659 JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of Service
Unauthenticated attackers can invoke arbitrary functions in the JupiterX Core plugin to read configuration, modify posts, or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1659?
CVE-2022-1659 is a medium-severity missing authorization vulnerability in ArtBees Jupiter X Core, published on 13 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
Weakness: CWE-284
Which versions are affected by CVE-2022-1659?
It affects 1 product.
Products include Artbees Jupiterx.
How do I fix CVE-2022-1659?
No fix has been published for CVE-2022-1659 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-1659 being exploited?
There is no known exploitation of CVE-2022-1659 in the wild and no public exploit code.
Other vulnerabilities in ArtBees Jupiter X Core
Sources
Also known as GHSA-4qp7-4vpc-hwfm.