« Volver al listado

CVE-2022-1551

Estado: ModificadaMedia (6.5)—

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Smartypantsplugins — SP Project & Document Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1551",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "SP Project & Document Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.58",
              "versionType": "custom"
            }
          ],
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-07-25T13:15:08.217",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files."
    },
    {
      "lang": "es",
      "value": "El plugin SP Project & Document Manager de WordPress versiones hasta 4.57, usa una ruta fácilmente adivinable para almacenar los archivos de usuarios, unos malos actores podrían usarlo para acceder a los archivos confidenciales de otros usuarios"
    }
  ],
  "lastModified": "2026-06-17T04:22:39.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smartypantsplugins:sp_project_\\&_document_manager:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8125CB0-1412-4A9B-8DC3-4D5D63F9BD2A",
              "versionEndExcluding": "4.58"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}