by Kastro
Paper/Archive/CVE-2022-2180

CVE-2022-2180

Unknown greyd_suite — GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.2.852 × 2017.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).

Affected

ProductAffectedFixed inSource
greyd_suite1.2.7 – < 1.2.71.2.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1