CVE-2024-27561

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-27561
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27561.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-27561
Published
2024-03-05T17:15:06Z
Modified
2025-01-22T02:02:43.008074Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.

References

Affected packages

Git / github.com/robiso/wondercms

Affected ranges

Type
GIT
Repo
https://github.com/robiso/wondercms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

1.*

1.1.0-beta
1.2.0-beta

2.*

2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0

3.*

3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.1
3.1.2
3.1.3