Medium severity · published Aug 22, 2022
CVE-2022-2552
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and…
5.3
CVSS
12%
EPSS
No
On KEV
Description
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.0% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DU
Duplicator · Awesomemotive
before 1.4.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2552
Exploit
https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2552
Exploit
https://wpscan.com/vulnerability/6b540712-fda5-4be6-ae4b-bd30a9d9d698
More from Duplicator
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
9.8
CVE-2018-25095
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files
9.8
CVE-2018-17207
An issue was discovered in Snap Creek Duplicator before 1.2.42
7.5
CVE-2023-6114
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the…
7.5
CVE-2022-2551
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer…