CVE-2024-27563
Last modified
CVE-2024-27563 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wondercms | Wondercms | 3.1.3 |
References
- https://github.com/zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_pluginThemeUrl.mdExploit, Third Party Advisory
- https://github.com/zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_pluginThemeUrl.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-27563?
How severe is CVE-2024-27563?
How do I fix CVE-2024-27563?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-27537Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-2754A vulnerability classified as critical has been found in Sou…8.8
- CVE-2024-27558Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scriptin…6.1
- CVE-2024-27559Stupid Simple CMS v1.2.4 was discovered to contain a Cross-S…6.3
- CVE-2024-2756Due to an incomplete fix to CVE-2022-31629 https://github.c…6.5
- CVE-2024-27561A Server-Side Request Forgery (SSRF) in the installUpdateThe…8.1
- CVE-2024-27564pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc…6.5
- CVE-2024-27565A Server-Side Request Forgery (SSRF) in weixin.php of ChatGP…9.8
- CVE-2024-27567LBT T300- T390 v2.2.1.8 were discovered to contain a stack o…6.5
- CVE-2024-27568LBT T300-T390 v2.2.1.8 were discovered to contain a stack ov…6.5
- CVE-2024-27569LBT T300-T390 v2.2.1.8 were discovered to contain a stack ov…6.5
- CVE-2024-2757In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() r…7.5
Are you affected by CVE-2024-27563?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST