PT-2026-104251 · Yeswiki · Yeswiki
CVSS v4.0
6.9
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
YesWiki versions prior to 4.6.7
Description
An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary hosts and ports. This is achieved by submitting the
url parameter of the {{valeur}} action through the content parameter of the 'handlers/page/render.php' endpoint. This flaw enables the probing of internal HTTP services and the retrieval of response content that matches fiche markup.Recommendations
Update YesWiki to version 4.6.7 or later.
استغلال
إصلاح
SSRF
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Yeswiki