exploitDog

CVE-2023-5877

Опубликовано: 01 янв. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

Ссылки

https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:servit:affiliate-toolkit:*:*:*:*:*:wordpress:*:*

Версия до 3.4.3 (исключая)

EPSS

Процентиль: 63%

0.00447

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-3hh9-m6jx-r3jg

CVSS3: 9.8

github

около 2 лет назад

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

EPSS

Процентиль: 63%

0.00447

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-862