CVE-2017-20106

Name of the Vulnerable Software and Affected Versions Lithium Forum version 2017 Q1

Description A critical issue has been found in the Compose Message Handler component. The manipulation of the upload url argument leads to server-side request forgery. The attack must be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations For Lithium Forum version 2017 Q1, as a temporary workaround, consider restricting access to the Compose Message Handler component until a patch is available. Avoid using the upload url argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.