CVE-2022-2367CWE-639

WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass

published August 8, 2022

CVSS
—
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01179 · 67.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-08-08T13:47Z
EPSS history
Timeline
  • 08 AUG 13:47Z
    WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass
    cvelistv5