CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Explanation of Vulnerability in Simple Terms
BasePress versions up to 2.16.1 contain a server-side request forgery vulnerability. An authenticated user can make the site send HTTP requests to internal or external systems on the attacker's behalf. The scope is changed, meaning the impact may extend beyond the plugin itself. Low confidentiality impact is possible.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs under the site's identity.
Potential impact on your site
Authenticated users can probe your internal network, access internal services, or trigger actions on external systems.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
