CVE-2023-1971

Katalog CVE

CVSS 4.9 · Medium EPSS 0,64%

Kerentanan Server-Side Request Forgery (SSRF) pada tpadmin project tpadmin. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Rincian

Terbit di NVD

10 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tib36.github.io/2023/04/09/tpAdmin-SSRF/ exploit · advisory pihak ketiga
• https://vuldb.com/?ctiid.225408 permissions required · advisory pihak ketiga
• https://vuldb.com/?id.225408 advisory pihak ketiga