CVE-2022-50956
Local File Read in Amministrazione Aperta WordPress Plugin
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amministrazione_aperta | amministrazione_aperta | 3.7.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the WordPress plugin amministrazione-aperta version 3.7.3 is a local file read flaw. It allows unauthenticated attackers to read arbitrary files on the web server by exploiting insufficient input validation in the 'open' GET parameter of the dispatcher.php file.
Attackers can manipulate the 'open' parameter to supply file paths that the plugin then includes and reads, potentially exposing sensitive files accessible to the web server. This issue is due to improper restriction of file pathnames, classified as a path traversal vulnerability (CWE-22).
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to access sensitive files on your web server without authentication. Such unauthorized file access can lead to exposure of confidential information, configuration files, or other data that should remain protected.
Since the vulnerability allows reading arbitrary files, it can be used to gather information that might facilitate further attacks or compromise the security of your system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the dispatcher.php file of the amministrazione-aperta WordPress plugin, specifically looking for suspicious usage of the 'open' GET parameter that attempts to read arbitrary files.
You can use network monitoring tools or web server logs to identify requests containing path traversal patterns such as '../' or attempts to access sensitive files via the 'open' parameter.
Example commands to detect such attempts include:
- Using grep on web server access logs to find suspicious requests: grep "dispatcher.php?open=" /var/log/apache2/access.log | grep "\.\./"
- Using curl to test if the vulnerability exists by attempting to read sensitive files: curl "http://yourwordpresssite.com/wp-content/plugins/amministrazione-aperta/dispatcher.php?open=../../../../etc/passwd"
- Using intrusion detection systems (IDS) or web application firewalls (WAF) to alert on path traversal patterns in URL parameters.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the WordPress plugin amministrazione-aperta 3.7.3 allows unauthenticated attackers to read arbitrary files on the server by exploiting insufficient input validation. This could lead to unauthorized disclosure of sensitive information stored on the server.
Since the plugin is used by Italian public administrations to manage and publish open data related to grants, subsidies, economic benefits, and consultancy roles, unauthorized file access could expose sensitive or personal data, potentially violating data protection regulations such as GDPR.
Exposure of sensitive files due to this vulnerability could undermine compliance with standards and regulations that require protection of personal and sensitive data, including GDPR and potentially HIPAA if applicable data is involved.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the amministrazione-aperta WordPress plugin to version 3.8 or later, as the vulnerability was fixed in version 3.8 with security improvements.
If upgrading immediately is not possible, consider restricting access to the dispatcher.php file or the plugin directory via web server configuration to trusted users only.
Additionally, implement web application firewall (WAF) rules to block requests containing suspicious path traversal patterns in the 'open' parameter.
Regularly monitor web server logs for exploitation attempts and apply security patches promptly.