CVE-2022-3282 — MEDIUM (4.3)

Q: How severe is CVE-2022-3282?

CVE-2022-3282 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-3282?

Check the references section above for vendor advisories and patch information. Affected products include: Codedropz Drag And Drop Multiple File Upload - Contact Form 7.

Vulnerability Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Codedropz	Drag And Drop Multiple File Upload - Contact Form 7	< 1.3.6.5

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452cExploitThird Party Advisory
https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452cExploitThird Party Advisory

FAQ

What is CVE-2022-3282?

CVE-2022-3282 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. A...

How severe is CVE-2022-3282?

CVE-2022-3282 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-3282?

Check the references section above for vendor advisories and patch information. Affected products include: Codedropz Drag And Drop Multiple File Upload - Contact Form 7.