1. Home
  2. CVE Database
  3. CVE-2022-0687
HIGH · 8.8

CVE-2022-0687

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerabili...

Vulnerability Description

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Tms-OutsourceAmelia< 1.0.47

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2022-0687?

CVE-2022-0687 is a vulnerability with a CVSS score of 8.8 (HIGH). The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerabili...

How severe is CVE-2022-0687?

CVE-2022-0687 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-0687?

Check the references section above for vendor advisories and patch information. Affected products include: Tms-Outsource Amelia.