Vulnerability-Lookup

CVE-2022-4327 (GCVE-0-2022-4327)

Vulnerability from cvelistv5 – Published: 2023-01-16 15:37 – Updated: 2023-01-30 15:00

This issue does not bear any security risk as it's only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2023-01-30T15:00:41.522Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-4327",
    "datePublished": "2023-01-16T15:37:47.213Z",
    "dateRejected": "2023-01-30T15:00:41.522Z",
    "dateReserved": "2022-12-07T09:01:09.088Z",
    "dateUpdated": "2023-01-30T15:00:41.522Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.\"}]",
      "id": "CVE-2022-4327",
      "lastModified": "2023-11-07T03:57:33.320",
      "published": "2023-01-16T16:15:11.497",
      "sourceIdentifier": "contact@wpscan.com",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-4327\",\"sourceIdentifier\":\"contact@wpscan.com\",\"published\":\"2023-01-16T16:15:11.497\",\"lastModified\":\"2023-11-07T03:57:33.320\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.\"}],\"metrics\":{},\"references\":[]}}"
  }
}

FKIE_CVE-2022-4327

Vulnerability from fkie_nvd - Published: 2023-01-16 16:15 - Updated: 2023-11-07 03:57

Severity

Summary

Rejected reason: This issue does not bear any security risk as it's only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site."
    }
  ],
  "id": "CVE-2022-4327",
  "lastModified": "2023-11-07T03:57:33.320",
  "metrics": {},
  "published": "2023-01-16T16:15:11.497",
  "references": [],
  "sourceIdentifier": "contact@wpscan.com",
  "vulnStatus": "Rejected"
}

GHSA-WCQQ-JH3M-43F6

Vulnerability from github – Published: 2023-01-16 18:30 – Updated: 2023-01-24 21:30

Details

The Anti-Malware Security and Brute-Force Firewall WordPress plugin through 4.21.85 is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated as high privilege user could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-4327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-16T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Anti-Malware Security and Brute-Force Firewall WordPress plugin through 4.21.85 is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated as high privilege user could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input.",
  "id": "GHSA-wcqq-jh3m-43f6",
  "modified": "2023-01-24T21:30:30Z",
  "published": "2023-01-16T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4327"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/2c94e7b6-a9dd-47d4-bb17-20acb072c825"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-4327

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

This issue does not bear any security risk as it's only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.

Aliases

CVE-2022-4327

Aliases

CVE-2022-4327

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-4327",
    "description": "The Anti-Malware Security and Brute-Force Firewall WordPress plugin through 4.21.85 is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated as high privilege user could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input.",
    "id": "GSD-2022-4327"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-4327"
      ],
      "details": "This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.",
      "id": "GSD-2022-4327",
      "modified": "2023-12-13T01:19:15.211409Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "contact@wpscan.com",
        "ID": "CVE-2022-4327",
        "STATE": "REJECT"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site."
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:anti-malware_security_and_brute-force_firewall_project:anti-malware_security_and_brute-force_firewall:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.21.85",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-4327"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": []
            }
          ]
        },
        "references": {
          "reference_data": []
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-01-30T16:15Z",
      "publishedDate": "2023-01-16T16:15Z"
    }
  }
}

VAR-202301-1467

Vulnerability from variot - Updated: 2023-12-18 13:50

Rejected reason: This issue does not bear any security risk as it's only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site. The Anti-Malware Security and Brute-Force Firewall WordPress plugin up to and including 4.21.85 is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated as high privilege user could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202301-1467",
  "cve": "CVE-2022-4327",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [],
        "severity": [
          {
            "author": "CNNVD",
            "id": "CNNVD-202301-1222",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Rejected reason: This issue does not bear any security risk as it\u0027s only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site. The Anti-Malware Security and Brute-Force Firewall WordPress plugin up to and including 4.21.85 is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated as high privilege user could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-4327"
      },
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-4327"
      }
    ],
    "trust": 1.08
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-4327",
        "trust": 1.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-447225",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-4327",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-4327"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-4327"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "id": "VAR-202301-1467",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:50:43.026000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "WordPress plugin Anti-Malware Security and Brute-Force Firewall Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=222465"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-502",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.8,
        "url": "https://wpscan.com/vulnerability/2c94e7b6-a9dd-47d4-bb17-20acb072c825"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-4327/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/502.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-4327"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-4327"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-4327"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "date": "2023-01-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-4327"
      },
      {
        "date": "2023-01-16T16:15:11.497000",
        "db": "NVD",
        "id": "CVE-2022-4327"
      },
      {
        "date": "2023-01-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-447225"
      },
      {
        "date": "2023-01-17T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-4327"
      },
      {
        "date": "2023-11-07T03:57:33.320000",
        "db": "NVD",
        "id": "CVE-2022-4327"
      },
      {
        "date": "2023-02-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "WordPress plugin Anti-Malware Security and Brute-Force Firewall Code problem vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1222"
      }
    ],
    "trust": 0.6
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-4327 (GCVE-0-2022-4327)

FKIE_CVE-2022-4327

GHSA-WCQQ-JH3M-43F6

GSD-2022-4327

VAR-202301-1467

Tags

Sightings

Nomenclature