CVE-2022-3590
Assigner: WPScan
Published: 2022-12-14T08:33:40.434Z
State: PUBLISHED
title: WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
problemTypes: descriptions: description: CWE-918 Server-Side Request Forgery (SSRF)
type: CWE
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
type: CWE
affected: vendor: WordPress
product: WordPress
versions: status: affected
versionType: custom
version: 4.1.30
lessThanOrEqual: 6.1.1
defaultStatus: affected
descriptions: value: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
credits: value: Thomas Chauchefoin
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator