CVE-2024-41305

MEDIUM

WonderCMS 3.4.3 - Server-Side Request Forgery via pluginThemeUrl

Title source: manual
STIX 2.1

Description

A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.

References (1)

Core 1

Scores

CVSS v3 4.7
EPSS 0.0018
EPSS Percentile 7.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352 CWE-918
Status published
Products (1)
wondercms/wondercms 3.4.3
Published Jul 30, 2024
Tracked Since Feb 18, 2026