CVE-2022-2633: SSRF
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2633?
CVE-2022-2633 is considered a high severity vulnerability due to its potential for arbitrary file downloads.
How do I fix CVE-2022-2633?
To fix CVE-2022-2633, update the All-in-One Video Gallery plugin to version 2.6.1 or later.
Who is affected by CVE-2022-2633?
CVE-2022-2633 affects all users of the All-in-One Video Gallery plugin for WordPress versions up to and including 2.6.0.
What impact does CVE-2022-2633 have on users?
CVE-2022-2633 allows unauthenticated users to download sensitive files, leading to potential data exposure.
Is there a workaround for CVE-2022-2633?
Disabling the All-in-One Video Gallery plugin until updates are applied can serve as a temporary workaround for CVE-2022-2633.