CVE-2022-3401 Vulnerability Details

  /     /     /  

CVE-2022-3401 Metadata Quick Info

CVE Published: 28/10/2022 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: Wordfence | Vendor: Bricks Builder | Product: Bricks
Status : PUBLISHED

---

CVE-2022-3401 Description

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.

Metrics

CVSS Version: 3.1 | Base Score: 8.8 HIGH
Vector: CVSS:3.1/A:H/I:H/C:H/S:U/UI:N/PR:L/AC:L/AV:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-94 Improper Control of Generation of Code ( Code Injection )
Source: Bricks Builder

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).