CVE-2024-27563

A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2024-03-05

Updated

2024-08-29

Proof-of-concept exploits (1)

• zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_pluginThemeUrl.md

References

• CVE Record
• NVD entry

Related

• CVE-2019-17372
• CVE-2021-41277
• CVE-2021-43798
• CVE-2021-44259
• CVE-2021-44260
• CVE-2021-44261