SSRF in Google Web Stories
CVE-2022-3708
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.007 (49.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Google Web Stories — versions 0
- Google Web_stories
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Product, Third Party Advisory, Release Notes)
- security@wordfence.com (Patch, Third Party Advisory, Release Notes)
- security@wordfence.com (Patch, Third Party Advisory)
- security@wordfence.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-3708?
- CVE-2022-3708 is a critical-severity vulnerability in Google Web Stories, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.6/10. Published 2022-10-28.
- How severe is CVE-2022-3708?
- Critical severity. CVSS v3 base score is 9.6 out of 10.
- Is CVE-2022-3708 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.