PT-2023-30729 · Publiccms · Publiccms
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PublicCMS version 4.0.202302.e
Description
The issue allows a remote attacker to obtain sensitive information via the
appToken and Parameters parameter of the "api/method/getHtml" component.Recommendations
For PublicCMS version 4.0.202302.e, as a temporary workaround, consider restricting access to the "api/method/getHtml" component until a patch is available. Avoid using the
appToken and Parameters parameters in this component to minimize the risk of exploitation.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Publiccms