CVE-2020-28976

Опубликовано: 30 нояб. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Средний

Описание

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.

Ссылки

http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html
Third Party Advisory
VDB Entry
https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0
Third Party Advisory
https://github.com/CantoDAM/Canto-Wordpress-Plugin
Product
https://wordpress.org/plugins/canto/#developers
Release Notes
https://www.canto.com/integrations/wordpress/
Product
http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html
Third Party Advisory
VDB Entry
https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0
Third Party Advisory
https://github.com/CantoDAM/Canto-Wordpress-Plugin
Product
https://wordpress.org/plugins/canto/#developers
Release Notes
https://www.canto.com/integrations/wordpress/
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:canto:canto:1.3.0:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 96%

0.2575

Средний

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-cm65-67cq-fq4v

github

больше 3 лет назад