CVE-2024-4260 — Server-Side Request Forgery in Coblocks

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.7%
top 27.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Godaddy Coblocks
Timeline
PublishedJul 23

Description

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages1 packages

▶NVDgodaddy/coblocks< 3.1.12

🔴Vulnerability Details

2
GHSA
GHSA-5pqp-q4fm-4p4h: The Page Builder Gutenberg Blocks WordPress plugin before 3↗2024-07-23
▶
CVEList
CoBlocks < 3.1.12 - Contributor+ SSRF↗2024-07-23
▶
CVE-2024-4260 — Server-Side Request Forgery in Coblocks | cvebase