PT-2026-104252 · Yeswiki · Yeswiki
CVSS v4.0
6.9
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
YesWiki versions prior to 4.6.7
Description
An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary URLs. This is achieved by providing a syndication action via the
content parameter of the render handler. Attackers can target internal hosts and ports, retrieve fetched feed content within the rendered page, and trigger the download of feed enclosures into the files directory.Recommendations
Update YesWiki to version 4.6.7 or later.
استغلال
إصلاح
SSRF
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Yeswiki