CVE-2026-28508

Katalog CVE

CVSS 8.6 · High EPSS 0,75%

Kerentanan Server-Side Request Forgery (SSRF) pada withknown known. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6 exploit · mitigasi · advisory vendor
• https://github.com/idno/idno/releases/tag/1.6.4 product · release notes