medium4.9Public exploit code
CVE-2022-28117
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)2022-05-11 · webapps · php
Impact
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Naviwebs | Navigate Cms | Version 2.9.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
- https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
- https://www.youtube.com/watch?v=4kHW95CMfD0
- http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
- https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
- https://www.youtube.com/watch?v=4kHW95CMfD0