The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 | Exploit Patch Third Party Advisory |
Configurations
History
28 Sep 2022, 17:34
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
References | (MISC) https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 - Exploit, Patch, Third Party Advisory | |
First Time |
Ninjaforms
Ninjaforms ninja Forms |
|
CPE | cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:* |
26 Sep 2022, 13:18
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-09-26 13:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-2903
Mitre link : CVE-2022-2903
CVE.ORG link : CVE-2022-2903
JSON object : View
Products Affected
ninjaforms
- ninja_forms
CWE
CWE-502
Deserialization of Untrusted Data