CVE-2022-47635

Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php

Critical · published December 21, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

🚨 A sneaky server-side request forgery (SSRF) is lurking in Wildix WMS versions prior to 6.02.20221216, and it could let attackers access internal resources uninvited! 🔥 Think of it like a dinner invitation where the host serves the wrong address—an attacker could use this vulnerability to ask your server for a dish from the kitchen without you ever knowing! This could lead to absolute chaos! An attacker may gain unauthorized access to internal systems, potentially leading to sensitive data exposure or even further network compromise. The stakes are high when your server acts on requests it shouldn't!

Put simply

Think of it like a dinner invitation where the host serves the wrong address—an attacker could use this vulnerability to ask your server for a dish from the kitchen without you ever knowing! This SSRF vulnerability in Wildix WMS allows an attacker to manipulate the server to make requests to internal resources, which can bypass firewalls and other security mechanisms. If exploited, it can expose sensitive internal data.

What to do

This could lead to absolute chaos! An attacker may gain unauthorized access to internal systems, potentially leading to sensitive data exposure or even further network compromise. The stakes are high when your server acts on requests it shouldn't! Patch your Wildix WMS to versions 6.02.20221216, 5.04.20221214, or 4.04.45396.23 immediately to close this vulnerability. Review your network's settings to ensure internal resources are protected from unauthorized requests. Always keep your software up to date! You’ve got this! With these steps, you’ll be locking down your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.1th percentile
Published
2022-12-21T00:00Z
EPSS history
Timeline
  • 21 DEC 00:00Z
    Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php
    cvelistv5