Broken Link Checker Plugin up to 1.11.16 on WordPress log_file deserialization

Summaryinfo

A vulnerability has been found in Broken Link Checker Plugin up to 1.11.16 on WordPress and classified as critical. This vulnerability affects unknown code. Performing a manipulation of the argument log_file results in deserialization. This vulnerability was named CVE-2022-2438. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Broken Link Checker Plugin up to 1.11.16 on WordPress (WordPress Plugin). This affects an unknown part. The manipulation of the argument log_file with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

The weakness was presented 09/07/2022 as 2757773. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2022-2438 since 07/15/2022. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 2757773 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Broken Link Checker Plugin

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.11.10
• 1.11.11
• 1.11.12
• 1.11.13
• 1.11.14
• 1.11.15
• 1.11.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion