CVE-2024-27561

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-27561

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27561.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-27561

Published

2024-03-05T00:00:00Z

Modified

2026-08-12T03:51:10.033521238Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27561.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/wondercms/wondercms

Affected ranges

Type

GIT

Repo

https://github.com/wondercms/wondercms

Events

Introduced

f0d74f1d7aea282864311b8b954804179b5f8a97

Last affected

f0d74f1d7aea282864311b8b954804179b5f8a97

Database specific

Show details

{
    "cpe": "cpe:2.3:a:wondercms:wondercms:3.1.3:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.1.3"
        },
        {
            "last_affected": "3.1.3"
        }
    ]
}

Affected versions

3.*

3.1.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27561.json"