CVE-2022-28117

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

CVSS v3.1 NVD

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

22.90% chance of exploitation in the next 30 days, 98th percentile

Nuclei

medium · CWE-918

Published

2022-04-28

Updated

2024-08-03

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forger…
• https://www.youtube.com/watch?v=4kHW95CMfD0
• cheshireca7/CVE-2022-281172★ · 2022-07-06
• kimstars/POC-CVE-2022-281170★ · 2023-12-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28117.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50921

Security advisories

• https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5

References

• CVE Record
• NVD entry

Related

• CVE-2018-17552
• CVE-2026-21509