GitHub Advisoryadvisory · Packagist

GHSA-c3q8-hh69-7mg5 Codiad SSRF Vulnerability

HIGH Published 2022-05-24 Modified 2024-04-25 Official page ↗
Aliases
CVE-2020-14044
Ecosystem
Packagist
Packages
codiad/codiad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2024-04-25

Affected packages

• Packagist codiad/codiad: >= 1.7.8, <= 2.8.4 (no fix yet)

Description

A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."

Related

Alias · CVE (1)

  • CVE-2020-14044 ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References