1. Home
  2. CVE Database
  3. CVE-2024-48232
MEDIUM · 4.9

CVE-2024-48232

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec exec...

Vulnerability Description

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Mipjz ProjectMipjz5.0.5

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2024-48232?

CVE-2024-48232 is a vulnerability with a CVSS score of 4.9 (MEDIUM). An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec exec...

How severe is CVE-2024-48232?

CVE-2024-48232 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-48232?

Check the references section above for vendor advisories and patch information. Affected products include: Mipjz Project Mipjz.