Autoptimize < 3.1.0 - Information Disclosure

mediumseverity

5.3CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.

Impact

An attacker can gain access to sensitive information, potentially leading to further attacks.

Fix

Upgrade to Autoptimize version 3.1.0 or later to fix the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/uploads/ao_ccss/queuelog.html ; GET {{BaseURL}}/blog/wp-content/uploads/ao_ccss/queuelog.html
Positive when: contains "Job id &lt;" and "log messages" AND status 200

Run it with nuclei: nuclei -id CVE-2022-4057 -u <target>

The full check

id: CVE-2022-4057

info:
  name: Autoptimize < 3.1.0 - Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
  impact: |
    An attacker can gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Upgrade to Autoptimize version 3.1.0 or later to fix the information disclosure vulnerability.
  reference:
    - https://wpscan.com/vulnerability/95ee1b9c-1971-4c35-8527-5764e9ed64af
    - https://wordpress.org/plugins/autoptimize/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-4057
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-4057
    cwe-id: CWE-425
    epss-score: 0.01533
    epss-percentile: 0.7502
    cpe: cpe:2.3:a:optimizingmatters:autooptimize:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: optimizingmatters
    product: autooptimize
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/autoptimize
    fofa-query: body=/wp-content/plugins/autoptimize
    publicwww-query: /wp-content/plugins/autoptimize
  tags: cve,cve2022,wpscan,wp,wordpress,wp-plugin,disclosure,autoptimize,optimizingmatters,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/ao_ccss/queuelog.html"
      - "{{BaseURL}}/blog/wp-content/uploads/ao_ccss/queuelog.html"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Job id &lt;'
          - 'log messages'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from