漏洞描述
WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/852c257c-929a-4e4e-b85e-064f8dadd994↗blog.amanrawat.inhttps://blog.amanrawat.in/2022/09/28/CVE-2022-2633.html↗wordpress.orghttps://wordpress.org/plugins/all-in-one-video-gallery/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-2633↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227↗