Vulnerabilities > CVE-2022-3282 - Authorization Bypass Through User-Controlled Key vulnerability in Codedropz Drag and Drop multiple File Upload - Contact Form 7

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

codedropz

CWE-639

NVD

Published: 2022-10-17

Updated: 2022-10-20

Summary

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.

Vulnerable Configurations

Part	Description	Count
Application	Codedropz Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.0 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.1 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.1 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.2 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.3 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.4 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.5 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.5.0 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.2.6.0 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.0 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.1 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.2 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3.1 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3.2 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3.3 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3.3.1 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.3.3.2 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.4 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.5 Codedropz Drag AND Drop Multiple File Upload Contact Form 7 1.3.6.3	22

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

References

https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452c