CVE-2022-3708

Web Stories <= 1.24.0 - Server Side Request Forgery

CVSS 9.6 CRITICALEPSS 0.7%CWE-918

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.6EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

28 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

google · Web Stories

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/GoogleForCreators/web-stories-wp/commit/3ad2099f95155d658624ffac2e34ce0da739e34b https://github.com/GoogleForCreators/web-stories-wp/compare/v1.24.0...v1.25.0 https://wordpress.org/plugins/web-stories https://www.wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=cve https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3708