Server-Side Request Forgery in WonderCMS affects user data and security
CVE-2024-27563

5.3MEDIUM

Key Information:

Vendor

WonderCMS

Status
WonderCMS
Vendor
CVE Published:
5 March 2024
đź”” Create WonderCMS Vulnerability Alert

What is CVE-2024-27563?

A vulnerability exists in WonderCMS that allows attackers to exploit the getFileFromRepo function. By injecting carefully crafted URLs into the pluginThemeUrl parameter, an attacker may force the application to make arbitrary HTTP requests to potentially sensitive services, which could lead to unauthorized access and data exposure.

References

https://github.com/zer0yu/CVE_Request/blob/master/WonderC...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-27563 : Server-Side Request Forgery in WonderCMS affects user data and security