CVE-2022-3982: Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Published Dec 12, 2022
·Updated
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
Affected Software
1 affected component
WpDevArt Booking Calendar Wordpress<3.2.2
Event History
Dec 12, 2022
CVE Published
via MITRE·05:54 PM
Data Sourced
via MITRE·05:54 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-3982.
2
What is the severity of CVE-2022-3982?
The severity of CVE-2022-3982 is critical.
3
Which software is affected by CVE-2022-3982?
The Booking calendar Appointment Booking System WordPress plugin before version 3.2.2 is affected by CVE-2022-3982.
4
How does CVE-2022-3982 affect the affected software?
CVE-2022-3982 allows unauthenticated users to upload arbitrary files, such as PHP, and potentially achieve remote code execution on the affected software.
5
Is there a fix available for CVE-2022-3982?
Yes, updating the Booking calendar Appointment Booking System WordPress plugin to version 3.2.2 or higher will fix CVE-2022-3982.