Arbitrary Code Execution and Sensitive Information Theft via SSRF Vulnerability in Friendica
CVE-2024-25864

9.1CRITICAL

Key Information:

Vendor

Friendica

Status
Friendica
Vendor
CVE Published:
3 April 2024

What is CVE-2024-25864?

A Server Side Request Forgery (SSRF) vulnerability exists in Friendica versions beyond v.2023.12. This flaw enables a remote attacker to execute arbitrary code and access sensitive information through the fpostit.php component, potentially compromising the security and integrity of affected systems.

References

https://github.com/friendica/friendica/issues/13877

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.