{"containers": {"cna": {"affected": [{"product": "Amelia \u2013 Events & Appointments Booking Calendar", "vendor": "Unknown", "versions": [{"lessThan": "1.0.47", "status": "affected", "version": "1.0.47", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "qerogram"}], "descriptions": [{"lang": "en", "value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-21T18:55:57", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"}], "source": {"discovery": "EXTERNAL"}, "title": "Amelia < 1.0.46 - Manager+ RCE", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-0687", "STATE": "PUBLIC", "TITLE": "Amelia < 1.0.46 - Manager+ RCE"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Amelia \u2013 Events & Appointments Booking Calendar", "version": {"version_data": [{"version_affected": "<", "version_name": "1.0.47", "version_value": "1.0.47"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "qerogram"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-0687", "datePublished": "2022-03-21T18:55:57", "dateReserved": "2022-02-19T00:00:00", "dateUpdated": "2022-03-21T18:55:57", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tms-outsource:amelia:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "68626433-8C2F-452D-94CF-FB37BA2F9B70", "versionEndExcluding": "1.0.47", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."}, {"lang": "es", "value": "El plugin Amelia de WordPress versiones anteriores a 1.0.47, almacena los blobs de im\u00e1genes en archivos reales cuya extensi\u00f3n es controlada por el usuario, lo que puede conllevar a una carga de backdoors PHP en el sitio. Esta vulnerabilidad puede ser explotada por usuarios conectados con el rol personalizado \"Amelia Manager\""}], "id": "CVE-2022-0687", "lastModified": "2022-03-30T19:28:51.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-21T19:15:11.337", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "contact@wpscan.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}