CVE-2022-0499

CVE-2022-0499: Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF

Vendor Unknown
Product Sermon Browser
Weakness CWE-434 · Unrestricted file upload
Published March 28, 2022
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

Key dates

02Disclosure timeline

March 28, 2022 CVE published
August 2, 2024 Record updated