CVE-2022-4109: Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log Download
Published Jan 2, 2023
·Updated
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
Affected Software
1 affected component
CedCommerce Wholesale Market For Woocommerce Wordpress<2.0.0
Event History
Jan 2, 2023
CVE Published
via MITRE·09:49 PM
Data Sourced
via MITRE·09:49 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-4109.
2
What is the severity of CVE-2022-4109?
The severity of CVE-2022-4109 is low, with a severity value of 2.7.
3
What is affected by CVE-2022-4109?
The Wholesale Market for WooCommerce WordPress plugin before version 2.0.0 is affected by CVE-2022-4109.
4
What is the impact of CVE-2022-4109?
CVE-2022-4109 allows high privilege users, such as admin, to download arbitrary logs from the server even when they should not be able to.
5
How can I fix CVE-2022-4109?
To fix CVE-2022-4109, update to version 2.0.0 or later of the Wholesale Market for WooCommerce WordPress plugin.