by Kastro
Paper/Archive/CVE-2022-3921

CVE-2022-3921

Unknown Listingo — Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

EPSS 21%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.6.976 × 2019.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

Affected

ProductAffectedFixed inSource
Listingo< 3.2.73.2.7CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f