CVE-2022-2552 Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
Unauthenticated attackers can view sensitive system details like server software and file paths via the Duplicator plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2552?
CVE-2022-2552 is a medium-severity vulnerability in Unknown Duplicator, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Which versions are affected by CVE-2022-2552?
It affects 1 product.
Products include Awesomemotive Duplicator.
How do I fix CVE-2022-2552?
No fix has been published for CVE-2022-2552 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2552 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2552 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Unknown Duplicator
- CVE-2020-11738 WordPress Snap Creek Duplicator Plugin File Download
- CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
- CVE-2018-17207 Code injection in n/a
- CVE-2023-6114 Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
- CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
Sources
Also known as GHSA-g4pc-gj78-qfjj.