Lucene search

CERT-PLCVELIST:CVE-2024-5736

HistoryJun 28, 2024 - 11:26 a.m.

CVE-2024-5736 SSRF in AdmirorFrames Joomla! Extension

2024-06-2811:26:53

CWE-918

CERT-PL

www.cve.org

cve-2024-5736

ssrf

admirorframes

joomla! extension

afgdstream.php

vulnerability

localhost access

8.2 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N/AU:Y/U:Green/R:U/V:D/RE:L

0.001 Low

EPSS

Percentile

26.5%

JSON

Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.

CNA Affected

[
  {
    "collectionURL": "https://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-frames",
    "defaultStatus": "unaffected",
    "platforms": [
      "Joomla!"
    ],
    "product": "AdmirorFrames",
    "repo": "https://github.com/vasiljevski/admirorframes",
    "vendor": "Nikola Vasilijevski",
    "versions": [
      {
        "lessThan": "5.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/06/CVE-2024-5735/

cert.pl/posts/2024/06/CVE-2024-5735/

github.com/afine-com/CVE-2024-5736

github.com/sectroyer/CVEs/tree/main/CVE-2024-5736

github.com/vasiljevski/admirorframes/issues/3

8.2 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N/AU:Y/U:Green/R:U/V:D/RE:L

0.001 Low

EPSS

Percentile

26.5%

JSON

Related for CVELIST:CVE-2024-5736