CVE-2020-24140

2021-04-0716:15:13

Google

osv.dev

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.8%

JSON

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services.

CPENameOperatorVersion
wcmseq1.1.3
wcmseq0.1.6
wcmseq0.2.6
wcmseq0.1.3
wcmseq0.3.0
wcmseq0.1.1
wcmseq0.1.5
wcmseq0.1.2
wcmseq0.1.2.1
wcmseq0.2.2

Name	Operator	Version
wcms	eq	1.1.3
wcms	eq	0.1.6
wcms	eq	0.2.6
wcms	eq	0.1.3
wcms	eq	0.3.0
wcms	eq	0.1.1
wcms	eq	0.1.5
wcms	eq	0.1.2
wcms	eq	0.1.2.1
wcms	eq	0.2.2

Rows per page:

1-10 of 331

References

github.com/secwx/research/blob/main/cve/CVE-2020-24140.md

github.com/vedees/wcms/issues/11