Lucene search
GoogleOSV:GHSA-FWHC-MM9Q-MQQ8HistoryMay 22, 2024 - 9:30 p.m.
VuFind Server-Side Request Forgery (SSRF) vulnerability
2024-05-2221:30:34
Google
osv.dev
2
vufind
ssrf
vulnerability
cover show route
remote attackers
http servers
xss attacks
proxying
arbitrary urls
A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
| CPE | Name | Operator | Version |
|---|---|---|---|
| vufind/vufind | eq | 2.5 | |
| vufind/vufind | eq | 2.5.2 | |
| vufind/vufind | eq | 5.0 | |
| vufind/vufind | eq | 6.0 | |
| vufind/vufind | eq | 4.1.1 | |
| vufind/vufind | eq | 7.0 | |
| vufind/vufind | eq | 7.1 | |
| vufind/vufind | eq | 3.1 | |
| vufind/vufind | eq | 7.1.1 | |
| vufind/vufind | eq | 8.0.4 |
Related
cve
cve
CVE-2024-25737
2024-05-22 19:15:08
nvd
nvd
CVE-2024-25737
2024-05-22 19:15:08
osv
osv
CVE-2024-25737
2024-05-22 19:15:08
veracode
veracode
Server-Side Request Forgery (SSRF)
2024-05-27 07:16:27
cvelist
cvelist
CVE-2024-25737
1976-01-01 00:00:00
github
github
VuFind Server-Side Request Forgery (SSRF) vulnerability
2024-05-22 21:30:34