SSRF vulnerability in Likeshop allows attackers to view sensitive information
CVE-2024-24028

5.9MEDIUM

Key Information:

Vendor

Likeshop

Status
Likeshop
Vendor
CVE Published:
21 March 2024

What is CVE-2024-24028?

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.

References

https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.