CVE-2020-24139

2021-04-0715:03:05

mitre

www.cve.org

server-side request forgery

wcms 0.3.2

crafted requests

execute commands

identify open ports

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

56.2%

JSON

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.