CVE-2024-3448

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.

CVSS v3.1

5.0 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS

0.44% chance of exploitation in the next 30 days, 37th percentile

Published

2024-04-10

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0

References

• CVE Record
• NVD entry

Related

• CVE-2024-34474
• CVE-2024-34483
• CVE-2024-34472
• CVE-2024-34484
• CVE-2024-34470
• CVE-2024-34486