CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.2.
Explanation of Vulnerability in Simple Terms
The Video & Photo Gallery for Ultimate Member plugin contains a server-side request forgery vulnerability that allows authenticated users to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires low-level authentication and network access, but can affect systems beyond the plugin itself due to scope change. Affected versions are 1.1.2 and earlier.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs under the attacker's control.
Potential impact on your site
Attackers with user accounts can probe your internal network, access private services, or trigger actions on external systems.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
