CVE-2022-1560
Medium
Description
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
SeverityMedium
CVSS6.5
Exploit probability—
ProductAmministrazione Aperta
PublishedMay 16, 2022
First seenMay 16, 2022
Weakness typeCWE-22Path traversal
How to fix
Update
- amministrazione_aperta_project amministrazione_aperta3.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amministrazione_aperta_project amministrazione_aperta | v < 3.8 | 3.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.