CVE-2022-0499CWE-352CWE-434

Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF

published March 28, 2022

CVSS
—
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00628 · 49.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-03-28T17:22Z
EPSS history
Timeline
  • 28 MAR 17:22Z
    Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF
    cvelistv5