CVE-2020-24141

MEDIUM Year: 2020
CVSS v3 Score
5.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-918
View all →

Vulnerability Description

Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services

Related Vulnerabilities

CVE-2016-5968

MEDIUM
CVSS:5.3(Medium)

The Replay Server in IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9.0.2 before 9.0.2.12...

CWE-9182016

CVE-2017-15943

MEDIUM
CVSS:5.3(Medium)

The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7...

CWE-9182017

CVE-2017-16865

MEDIUM
CVSS:5.3(Medium)

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). When running in an envi...

CWE-9182017

CVE-2018-1000067

MEDIUM
CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited infor...

CWE-9182018

CVE-2018-2370

MEDIUM
CVSS:5.3(Medium)

Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allow a malicious user to use common techniqu...

CWE-9182018

CVE-2019-12996

MEDIUM
CVSS:5.3(Medium)

In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe.

CWE-9182019