Описание
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.0.0 (включая)
cpe:2.3:a:craw-data_project:craw-data:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 48%
0.00251
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-918
CWE-918
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
EPSS
Процентиль: 48%
0.00251
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-918
CWE-918