by Kastro
Paper/Archive/CVE-2022-4748

CVE-2022-4748

VulDB — FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.0.610 × 2012.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.

Affected

ProductAffectedFixed inSource
FlatPressn/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)5.5CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.5CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

writeupvuldb.com/?id.216861refvuldb.com/?ctiid.216861refgithub.com/flatpressblog/flatpress/issues/179patchgithub.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170