Vulnerabilities > CVE-2022-41477 - Server-Side Request Forgery (SSRF) vulnerability in Webidsupport Webid

CVSS 9.1 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

webidsupport

CWE-918

critical

NVD

Published: 2022-10-14

Updated: 2022-10-20

Summary

A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories.

Vulnerable Configurations

Part	Description	Count
Application	Webidsupport Webidsupport Webid 1.0.3 Webidsupport Webid 1.0.4 Webidsupport Webid 1.0.5 Webidsupport Webid 1.0.6 Webidsupport Webid 1.1.0 Webidsupport Webid 1.1.1 Webidsupport Webid 1.1.2 Webidsupport Webid 1.2.0 Webidsupport Webid 1.2.1 Webidsupport Webid 1.2.2	10

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

References

https://github.com/zer0yu/CVE_Request/blob/master/Webid/WeBid_Path_Traversal.md