CVE-2019-13020

The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the browser have with the website and could serve malicious content from a third-party attacker-controlled system. Second, arguably more severe, is the potential for an attacker to circumvent firewall controls, by proxying traffic, unauthenticated, into the internal network from the internet.

• CWE-918

• https://www.carouselsignage.com/release-notes/carousel-7-1-3Release Notes
• https://www.carouselsignage.com/release-notes/carousel-7-1-3Release Notes

Published

Aug 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13010An issue was discovered in GitLab Enterprise Edition 8.3 thr…5.9
• CVE-2019-13011An issue was discovered in GitLab Enterprise Edition 8.11.0 …4.3
• CVE-2019-13012The keyfile settings backend in GNOME GLib (aka glib2.0) bef…
• CVE-2019-13013Little Snitch versions 4.3.0 to 4.3.2 have a local privilege…5.5
• CVE-2019-13014Little Snitch versions 4.4.0 fixes a vulnerability in a priv…5.5
• CVE-2019-1302An elevation of privilege vulnerability exists when a ASP.NE…8.8
• CVE-2019-13021The administrative passwords for all versions of Bond JetSel…6.5
• CVE-2019-13022Bond JetSelect (all versions) has an issue in the Java class…9.8
• CVE-2019-13023An issue was discovered in all versions of Bond JetSelect. W…6.5
• CVE-2019-13024Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centr…
• CVE-2019-13025Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices ha…9.8
• CVE-2019-13026OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows …