CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through <= 3.0.33.
Explanation of Vulnerability in Simple Terms
Comment Edit Core allows high-privilege users to make the site send HTTP requests to internal or external systems on the attacker's behalf. An attacker with admin or equivalent access can craft requests that leak sensitive data or interact with services the site can reach. The vulnerability requires high privileges and complex attack setup, limiting its practical impact.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs to read data or trigger actions.
Potential impact on your site
A compromised admin account could be used to access internal services, leak configuration data, or attack other systems on your network.
Conditions required to exploit
Attacker must have high-level site privileges (admin or equivalent); no user interaction required.
Key dates
External resources
Related vulnerabilities
