CVE-2023-3744 CRITICAL

CVE-2023-3744: Server-Side Request Forgery in SLiMS

Vendor Slims

Product SLiMS

Weakness CWE-918 · SSRF

Published October 2, 2023

Last update September 20, 2024

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.

Key dates

02Disclosure timeline

October 2, 2023 CVE published

September 20, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-3744 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html

Related vulnerabilities

04Related CVE

CVE-2025-58829 WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins CVE-2023-4878 Server-Side Request Forgery (SSRF) in instantsoft/icms2 CVE-2026-44589 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability