CVE-2022-1239: HubSpot < 8.8.15 - Contributor+ Blind SSRF
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the editposts capability (by default contributor and above) to perform SSRF attacks
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1239?
CVE-2022-1239 is considered a moderate severity vulnerability due to the potential for SSRF attacks.
How do I fix CVE-2022-1239?
To remediate CVE-2022-1239, update the HubSpot WordPress plugin to version 8.8.15 or later.
Who is affected by CVE-2022-1239?
Users with the edit_posts capability, which typically includes contributors and above, are affected by CVE-2022-1239.
What is an SSRF attack in the context of CVE-2022-1239?
In the context of CVE-2022-1239, an SSRF attack occurs when an attacker tricks the server into making requests to internal or local services.
When was CVE-2022-1239 disclosed?
CVE-2022-1239 was disclosed as a vulnerability affecting versions of the HubSpot WordPress plugin prior to 8.8.15.