CVE-2022-3124
Published: 03 October 2022
Summary
CVE-2022-3124 is a medium-severity Missing Authorization (CWE-862) vulnerability in Najeebmedia Frontend File Manager. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Frontend File Manager Plugin for WordPress before version 21.3 contains a missing authorization vulnerability (CWE-862) that permits unauthenticated users to rename files previously uploaded by other users. The plugin also fails to validate the destination filename supplied during the rename operation, enabling modification of arbitrary files on the underlying web server. The issue received a CVSS 3.1 score of 5.3 reflecting network attack vector, low complexity, and no required privileges or user interaction.
An unauthenticated attacker can therefore send crafted requests to rename any uploaded file and, by supplying a crafted destination path, overwrite or alter arbitrary server files, resulting in limited integrity impact without affecting confidentiality or availability.
The referenced WPScan advisory identifies the affected plugin versions and indicates that the flaw is resolved in release 21.3; administrators should apply the update to eliminate the unauthorized rename capability. The associated EPSS score has remained flat at 0.0866 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-42551
Vulnerability details
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of…
more
arbitrary files on the web server
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.