CVE-2023-3578 MEDIUM

CVE-2023-3578: DedeCMS co_do.php server-side request forgery

Vendor N/A

Product DedeCMS

Weakness CWE-918 · SSRF

Published July 10, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.

Key dates

02Disclosure timeline

July 10, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-3578

Related vulnerabilities

04Related CVE

CVE-2024-38791 WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-15264 FeehiCMS TimThumb timthumb.php server-side request forgery CVE-2025-10397 Magicblack MacCMS API server-side request forgery CVE-2026-11469 jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery CVE-2026-34225 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality