CVE-2024-48232

An issue was found in mipjz 5.0.5

Medium · published October 25, 2024

CVSS v3.1
4.9
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.6th percentile
Published
2024-10-25T00:00Z
EPSS history
Timeline
  • 25 OCT 00:00Z
    An issue was found in mipjz 5.0.5
    cvelistv5