Design/Logic Flaw

The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the browser have with the website and could serve malicious content...

CVE-2019-13020

The CVE-2019-13020 issue affects Tightrope Media Carousel prior to 7.1.3. The vulnerability stems from the CarouselAPI/v0/fetch?url= endpoint, enabling SSRF. Risks described include: (1) phishing-style content hijacking the user’s trust with the site and browser by serving malicious content from ...

CVE-2019-13020: Server-Side Request Forgery (SSRF)

The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the browser have with the website and could serve malicious content...

PT-2019-13081

Name of the Vulnerable Software and Affected Versions Tightrope Media Carousel versions prior to 7.1.3 Description The issue concerns the fetch API in Tightrope Media Carousel, which is susceptible to Server-Side Request Forgery SSRF attacks via the CarouselAPI/v0/fetch?url= endpoint. This could ...