CVE-2022-1239CWE-918

HubSpot < 8.8.15 - Contributor+ Blind SSRF

published May 2, 2022

CVSS
—
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01417 · 72.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-05-02T16:05Z
EPSS history
Timeline
  • 02 MAY 16:05Z
    HubSpot < 8.8.15 - Contributor+ Blind SSRF
    cvelistv5