CVE-2022-1239

HubSpot < 8.8.15 - Contributor+ Blind SSRF

State: Published
Severity: Not scored
Published: May 2, 2022
Updated: Aug 2, 2024
Reserved: Apr 5, 2022

Description

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

Scores

The record has no CVSS score.

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
HubSpot – CRM, Email Marketing, Live Chat, Forms & AnalyticsUnknown	8.8.15 to before 8.8.15Affected

References

https://wpscan.com/vulnerability/4ad2bb96-87a4-4590-a058-b03b33d2fcee

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.