HubSpot <= 8.8.13 is vulnerable to Blind Server-Side Request Forgery (SSRF) vulnerability

Contributor

Published
2022-04-10

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

CVE

https://www.cve.org/CVERecord?id=CVE-2022-1239

CVSS

Score:6.4

Severity:Medium

Version: 8.8.13

There is a patch available in v8.8.15 and we strongly recommend you update to this version as soon as possible.