HubSpot < 8.8.15 - Contributor+ Blind SSRF
CVE-2022-1239

8.8HIGH

Key Information:

Vendor
Wordpress
Status
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
Vendor
CVE Published:
2 May 2022

Summary

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

Affected Version(s)

HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics 8.8.15

References

https://wpscan.com/vulnerability/4ad2bb96-87a4-4590-a058-...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brandon Roldan
.