CVE-2022-3708

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-370807.8TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg.CVE-2022-370817.8TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTCVE-2022-370827.8TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the functiCVE-2022-370837.8TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDCVE-2022-370847.8TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function.CVE-2022-370859.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the AddWlanMacList function.CVE-2022-370869.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed.CVE-2022-370879.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetMobileAPInfoById.CVE-2022-370889.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAP5GWifiById.CVE-2022-370899.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EditMacList.CVE-2022-37098.4A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases CVE-2022-370909.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID.