Server-Side Request Forgery Vulnerability in PublicCMS by Sanluan
CVE-2024-40544

8.8HIGH

Key Information:

Vendor

Publiccms

Status
Publiccms
Vendor
CVE Published:
12 July 2024

What is CVE-2024-40544?

A vulnerability has been identified in PublicCMS versions, specifically version 4.0.202302.e, where an attacker may exploit a Server-Side Request Forgery (SSRF) via the /admin/#maintenance_sysTask/edit component. This flaw allows unauthorized requests to be sent from the server, which could result in exposure of sensitive data or a subsequent compromise of the server’s internal network. It is crucial for organizations using this version of PublicCMS to apply security updates and thoroughly evaluate their systems for potential exploitation.

References

https://gitee.com/sanluan/PublicCMS/issues/IAAIX8

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.