CVE-2024-41305

Published Jul 30, 2024

Last updated 3 months ago

CVSS medium 4.7

Overview

Description: A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.7
Impact score: 3.4
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-918
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wondercms:wondercms:3.4.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF7DC199-D4A1-44A2-977F-E614C0F6B98A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References