CVE-2024-24028

EUVD-2024-21454
Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA-ADPADP
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
likeshoplikeshop
𝑥
< 2.5.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028
https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028