CVE-2023-2287

CWE-918 — Server-Side Request Forgery (SSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 68.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Orbit FOX BY ThemeisleThemeisle Orbitfox
Timeline
PublishedMay 30

Description

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDthemeisle/orbitfox< 2.10.24
▶CVEListV5unknown/orbit_fox_by_themeisle< 2.10.24

🔴Vulnerability Details

2
CVEList
Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery↗2023-05-30
▶
GHSA
GHSA-pq5g-3m7v-mf66: The Orbit Fox by ThemeIsle WordPress plugin before 2↗2023-05-30
▶