CVE-2022-3590: WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
First published: Wed Dec 14 2022(Updated: )
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress WordPress | >=4.2<=6.1.1 | |
| WordPress WordPress | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this WordPress vulnerability?
The vulnerability ID of this WordPress vulnerability is CVE-2022-3590.
What is the severity rating of CVE-2022-3590?
The severity rating of CVE-2022-3590 is medium (5.9).
How does the vulnerability in the pingback feature of WordPress affect the system?
The vulnerability allows for an unauthenticated blind server-side request forgery (SSRF) attack, potentially exposing internal hosts that are explicitly forbidden.
Which versions of WordPress are affected by this vulnerability?
WordPress versions 4.1 to 6.1.1 are affected by this vulnerability.
How can I fix the CVE-2022-3590 vulnerability in my WordPress installation?
To fix the vulnerability, update your WordPress installation to a version that has been patched to address CVE-2022-3590.
- agent/references
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/wordpress
- canonical/wordpress wordpress
- version/wordpress wordpress/4.2
- version/wordpress wordpress/6.1.1
- version/wordpress wordpress/4.1