CVE-2022-3708

ALTO 8.1CVE-2022-3708 · Published 28/10/2022 · updated 17/06/2026

En resumen

CVE-2022-3708 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a web stories (google).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 65.3% de las vulnerabilidades.
Solución: actualizar a 1.25.0 o posterior.

Package	Affected versions	Patched versions
web stories google	`< 1.25.0`	`1.25.0`

Description

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

References

GoogleForCreators/web-stories-wp commit 3ad2099 · Patch
GoogleForCreators/web-stories-wp · Patch
wordpress.org/plugins/web-stories · Product
wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e · Third Party Advisory
wordfence.com/vulnerability-advisories-continued · Third Party Advisory

Más vulnerabilidades de web stories

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free