marcantondahmen/automad · Security
Authenticated Blind SSRF in automad/automad
- GHSA ID
- GHSA-q5q3-qm26-9jwm
- CVE ID
- CVE-2023-7037
- Severity
- low
- Published
- Updated
- CVSS
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v3
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
automad up to 1.10.9 is vulnerable to an authenticated blind server-side request forgery in importUrl as the import function on the FileController.php file was not properly validating the value of the importUrl argument. This issue may allow attackers to perform a port scan against the local environment or abuse some service.
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)