CVE-2020-24139

2021-04-0716:15:13

Google

osv.dev

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.3%

JSON

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.

CPENameOperatorVersion
wcmseq1.1.3
wcmseq0.1.6
wcmseq0.2.6
wcmseq0.1.3
wcmseq0.3.0
wcmseq0.1.1
wcmseq0.1.5
wcmseq0.1.2
wcmseq0.1.2.1
wcmseq0.2.2

Name	Operator	Version
wcms	eq	1.1.3
wcms	eq	0.1.6
wcms	eq	0.2.6
wcms	eq	0.1.3
wcms	eq	0.3.0
wcms	eq	0.1.1
wcms	eq	0.1.5
wcms	eq	0.1.2
wcms	eq	0.1.2.1
wcms	eq	0.2.2

Rows per page:

1-10 of 331

References

github.com/secwx/research/blob/main/cve/CVE-2020-24139.md

github.com/vedees/wcms/issues/8