CVE-2024-27563

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-27563

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27563.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-27563

Published

2024-03-05T00:00:00Z

Modified

2026-07-15T01:48:55.841572884Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27563.json"
}

References

Affected packages

Git / github.com/wondercms/wondercms

Affected ranges

Type

GIT

Repo

https://github.com/wondercms/wondercms

Events

Introduced

f0d74f1d7aea282864311b8b954804179b5f8a97

Last affected

f0d74f1d7aea282864311b8b954804179b5f8a97

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.1.3"
        },
        {
            "last_affected": "3.1.3"
        }
    ],
    "cpe": "cpe:2.3:a:wondercms:wondercms:3.1.3:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

3.*

3.1.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27563.json"