CVE-2022-1386: Fusion Builder < 3.6.2 - Unauthenticated SSRF
Fusion Builder Project · Fusion Builder
Fixed in 3.6.2 · Affected: Fusion Builder Project before 3.6.2 · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 99% of scored CVEs
Not scored yet. The CVE record carries no CVSS score.
DescriptionCVE.org
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Fusion Builderfrom 3.6.2 before 3.6.2
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Server-Side Request Forgery
- Published
- May 2022
CoverageNo articles yet
No CyberSIXT article names CVE-2022-1386 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.