CVE-2022-2912: Craw Data <= 1.0.0 - Server Side Request Forgery
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2912?
CVE-2022-2912 has a medium severity level due to the potential for Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2022-2912?
To fix CVE-2022-2912, update the Craw Data WordPress plugin to a version later than 1.0.0 or implement proper nonce checks in the code.
Who is affected by CVE-2022-2912?
CVE-2022-2912 affects all installations of the Craw Data WordPress plugin version 1.0.0 and below.
What is the exploit mechanism for CVE-2022-2912?
CVE-2022-2912 exploits the lack of nonce checks, allowing attackers to manipulate the URL values via a logged-in admin.
Can CVE-2022-2912 lead to data leakage?
Yes, CVE-2022-2912 can potentially lead to data leakage as it enables unwanted crawls on third-party sites.