CVE-2022-2438 Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization

What is CVE-2022-2438?

CVE-2022-2438 is a high-severity unsafe deserialization vulnerability in wpmudev Broken Link Checker, published on 6 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

Weakness: CWE-502

Which versions are affected by CVE-2022-2438?

It affects 1 product.

Products include Managewp Broken Link Checker.

How do I fix CVE-2022-2438?

No fix has been published for CVE-2022-2438 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-2438 being exploited?

There is no known exploitation of CVE-2022-2438 in the wild and no public exploit code.

Other vulnerabilities in wpmudev Broken Link Checker

• CVE-2023-23737 WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection Critical 9.3
• CVE-2019-16521 Cross-site scripting in n/a Medium 6.1
• CVE-2019-17207 Cross-site scripting in n/a Medium 5.4
• CVE-2022-3922 Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting Medium 4.8
• CVE-2024-10903 Broken Link Checker < 2.4.2 - Admin+ SSRF Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3pxc-92w9-cmx7.