CVE-2022-2367 WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass

Q: What is CVE-2022-2367?

CVE-2022-2367 is a high-severity vulnerability in Unknown WSM Downloader, published on 8 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2022-2367 being exploited?

There is no known exploitation of CVE-2022-2367 in the wild and no public exploit code.

Q: How do I fix CVE-2022-2367?

No fix has been published for CVE-2022-2367 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 8 Aug 2022 Updated 3 Aug 2024

Attackers can bypass domain restrictions in the WSM Downloader plugin to download files from unauthorized websites due to insufficient parameter validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-2367?

CVE-2022-2367 is a high-severity vulnerability in Unknown WSM Downloader, published on 8 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation

Weakness: CWE-639

Which versions are affected by CVE-2022-2367?

It affects 1 product.

Products include Wsm Downloader Project Wsm Downloader.

How do I fix CVE-2022-2367?

No fix has been published for CVE-2022-2367 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-2367 being exploited?

There is no known exploitation of CVE-2022-2367 in the wild and no public exploit code.

CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download High 7.5

Sources

Also known as GHSA-vm96-qm8v-2cgx.