CVE-2022-0687: Amelia < 1.0.46 - Manager+ RCE
Published Mar 21, 2022
·Updated
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Affected Software
1 affected component
Tms-outsource Amelia Wordpress<1.0.47
Event History
Mar 21, 2022
CVE Published
via MITRE·06:55 PM
Data Sourced
via MITRE·06:55 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2022-0687.
2
What is the severity level of CVE-2022-0687?
The severity level of CVE-2022-0687 is high (8.8).
3
What is the affected software for CVE-2022-0687?
The affected software for CVE-2022-0687 is the Amelia WordPress plugin before version 1.0.47.
4
How can this vulnerability be exploited?
This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
5
Is there a fix available for CVE-2022-0687?
Yes, updating to version 1.0.47 of the Amelia WordPress plugin fixes this vulnerability.