CVE-2022-2903

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

he Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

References

Link	Resource
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864	Exploit Patch Third Party Advisory
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:01

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 - Exploit, Patch, Third Party Advisory~~	() https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 - Exploit, Patch, Third Party Advisory

Information

Published : 2022-09-26 13:15

Updated : 2025-05-21 20:15

NVD link : CVE-2022-2903

Mitre link : CVE-2022-2903

CVE.ORG link : CVE-2022-2903

JSON object : View

Products Affected

ninja_forms

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2022-2903", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-09-26T13:15:10.513", "references": [{"url": "https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog."}, {"lang": "es", "value": "El plugin Ninja Forms Contact Form de WordPress versiones anteriores a 3.6.13, no serializa el contenido de un archivo importado, lo que podr\u00eda conllevar a problemas de inyecciones de objetos PHP cuando un administrador importa (intencionadamente o no) un archivo malicioso y una cadena de gadgets apropiada est\u00e1 presente en el blog."}], "lastModified": "2025-05-21T20:15:28.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "E5207260-DBAE-4676-9626-3173864F07DB", "versionEndExcluding": "3.6.13"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}