CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
Explanation of Vulnerability in Simple Terms
ProfileGrid versions up to 5.9.5.2 contain a server-side request forgery vulnerability that allows an authenticated attacker to make the site send HTTP requests to internal or external systems on their behalf. The attacker needs a low-privilege account and the vulnerability affects the confidentiality and integrity of data accessible to the site. No user interaction is required.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers under the site's identity.
Potential impact on your site
Authenticated users can probe your internal network, access internal services, or trigger actions on external systems.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
