CVE-2020-24139

HIGH

wcms 0.3.2 - Server-Side Request Forgery via wex/cssjs.php Path Parameter

Title source: llm
STIX 2.1

Description

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.

References (2)

Core 2
Core References
Exploit, Technical Description x_refsource_misc
https://github.com/vedees/wcms/issues/8

Scores

CVSS v3 8.3
EPSS 0.0105
EPSS Percentile 60.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-918
Status published
Products (1)
wcms/wcms 0.3.2
Published Apr 07, 2021
Tracked Since Feb 18, 2026