CVE-2022-25485
Published: 15 March 2022
Summary
CVE-2022-25485 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Cuppacms Cuppacms. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CuppaCMS version 1.0 contains a local file inclusion vulnerability in the url parameter of /alerts/alertLightbox.php. The flaw is tracked as CVE-2022-25485 and is assigned CWE-829. It received a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, no required privileges, and required user interaction, with high impact to confidentiality, integrity, and availability.
An attacker who can supply a crafted URL value to the affected script can force inclusion of arbitrary local files. Because the vector is local and user interaction is required, successful exploitation typically occurs when a victim opens a malicious link or file on an affected system, enabling the attacker to read sensitive files or potentially execute code depending on the included content.
The two referenced GitHub issues provide no public advisory text or patch details. The EPSS score has remained near its observed peak of 0.3763 with a current value of 0.3616, indicating sustained moderate exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30154
Vulnerability details
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.