CVE-2022-45835 - WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

Back Back to CVE browser

HIGH

WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

Published Nov 13, 2023

7.5

HIGH

CVSS 3.1

EPSS 37.67%

Description

Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.

Affected products

Vendor PhonePe Product PhonePe Payment Solutions Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=1.0.15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PhonePe

PhonePe Payment Solutions

unaffected

Version	Status	Constraints
-	affected	<=1.0.15

Vendor Phonepe Product Phonepe Payment Solutions Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.0.15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Phonepe

Phonepe Payment Solutions

n/a

Version	Status	Constraints
0	affected	<=1.0.15

Remediation

Vendor solution

Update to 2.0.0 or a higher version.

Weaknesses (1)

CWE-918

SSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48689
Advisory
https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf?_s_id=cve
vdb-entryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48689		Advisory
https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf?_s_id=cve		vdb-entryThird Party Advisory