CyberSecBulletin
CVE-2022-2633NVD status: Modified

All-in-One Video Gallery: Externally Controlled Reference to a Resource in Another Sphere

Published Updated By the CyberSecBulletin desk

CVE-2022-2633 is a high-severity externally controlled reference to a resource in another sphere vulnerability in All-in-One Video Gallery from Plugins360, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected All-in-One Video Gallery versions: 2.5.8 through 2.6.0. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 35.7% chance of exploitation within 30 days, which is in the top 1.51% of all scored CVEs.

Patch this week

EPSS places it among the vulnerabilities most likely to be exploited soon.

What to do

  1. Check which version of All-in-One Video Gallery you run against the affected versions below, and install the vendor's latest release.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Plugins360All-in-One Video Gallery2.5.8 through 2.6.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA (wordfence.com)
CVSS 3.18.2HighNVD

Official description

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

More Externally Controlled Reference to a Resource in Another Sphere vulnerabilities (CWE-610)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in All-in-One Video Gallery

All All-in-One Video Gallery vulnerabilities

Recent Externally Controlled Reference to a Resource in Another Sphere vulnerabilities

Spotted an error? Tell us.