Lucene search
PRIOn knowledge basePRION:CVE-2024-0628HistoryFeb 07, 2024 - 7:15 a.m.
Server side request forgery (ssrf)
2024-02-0707:15:00
PRIOn knowledge base
www.prio-n.com
6
wp rss aggregator
server-side request forgery
vulnerable plugin
web requests
arbitrary locations
authenticated attackers
internal services
The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp_rss_aggregator | le | 4.23.5 |
Related
nvd
nvd
CVE-2024-0628
2024-02-07 07:15:07
cve
cve
CVE-2024-0628
2024-02-07 07:15:07
wpvulndb
wpvulndb
cvelist
cvelist
CVE-2024-0628
2024-02-07 06:46:56
wordfence
wordfence