CVE-2022-4171CWE-1284

demon image annotation <= 5.0 - Improper Input Restriction Validation

Medium · published December 13, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2022-12-13T20:16Z
EPSS history
Timeline
  • 13 DEC 20:16Z
    demon image annotation <= 5.0 - Improper Input Restriction Validation
    cvelistv5