Bug 886027 (CVE-2022-3590)

Summary:	www-apps/wordpress: SSRF
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	trivial	CC:	web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-12-15 06:06:23 UTC

CVE-2022-3590 (https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11):
https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Unfortunately, seems unfixed upstream and known for a while.