Vulnerability Details CVE-2022-28117
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.671
EPSS Ranking 98.5%
CVSS Severity
CVSS v3 Score 4.9
CVSS v2 Score 4.0
References
- http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
- https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
- https://www.youtube.com/watch?v=4kHW95CMfD0
- http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
- https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
- https://www.youtube.com/watch?v=4kHW95CMfD0
Products affected by CVE-2022-28117
-
cpe:2.3:a:naviwebs:navigate_cms:2.9.4