CVE-2024-25181
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A critical vulnerability in givanz VvvebJs 1.7.2 allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. It stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
Risk Assessment
An attacker can exploit SSRF to scan internal networks or read arbitrary files from the server, potentially leading to sensitive data leakage.
Recommendation
Update VvvebJs to the latest version or implement protections such as URL validation and restricting access to the file_get_contents function.
Other vulnerabilities in VvvebJs
See all- CVE-2024-27480Critical
givanz VvvebJs 1.7.2 is vulnerable to insecure file upload, which may allow an attacker to upload malicious files to the server.
- CVE-2024-25182Critical
givanz VvvebJs 1.7.2 suffers from a file upload vulnerability via save.php, which may allow an attacker to upload dangerous files.
- CVE-2024-25183High
givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
Original NVD description (English source)
A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS