CVE-2020-5519

CRITICAL

OpenLiteSpeed < 1.6.5 - Unauthenticated Server-Side Request Forgery via WebAdmin Console

Title source: llm
STIX 2.1

Description

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.

References (2)

Core 2
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://drive.google.com/open?id=1pSciFEfjHp3kN8y5shy_zosJo7dje_fX

Scores

CVSS v3 9.8
EPSS 0.0120
EPSS Percentile 64.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
litespeedtech/openlitespeed < 1.6.5
Published Jan 06, 2020
Tracked Since Feb 18, 2026