CVE-2023-3744

CRITICAL

9.9

Descricao

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.

Detalhes CVE

Pontuacao CVSS v3.19.9

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado10/2/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

slims:senayan_library_management_system

Fraquezas (CWE)

CWE-918CWE-918

Referencias

https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims(cve-coordination@incibe.es)

https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.