CVE-2024-0677

Published Mar 28, 2024

Last updated 3 days ago

CVSS medium 5.1

Overview

Description: The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.1
Impact score: 4.2
Exploitability score: 0.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-918

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:popozure:pz-linkcard:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DF7FEF00-D39F-429D-8B21-77D6A61AA830",
            "versionEndExcluding": "2.5.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References