CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.
Explanation of Vulnerability in Simple Terms
MakeStories for Google Web Stories versions 3.0.4 and earlier contain a server-side request forgery vulnerability. An authenticated administrator can craft requests that cause the site to make HTTP calls to internal or external systems on the attacker's behalf. The impact is limited to reading non-sensitive data and making minor modifications. Scope is changed, meaning the vulnerability may affect systems beyond the plugin itself.
What an attacker can do
Make the site send HTTP requests to internal or external systems and read limited data from responses.
Potential impact on your site
An admin account compromise could allow an attacker to probe your internal network or exfiltrate non-sensitive data via the site.
Conditions required to exploit
Attacker must have administrator-level access to the site; no user interaction required.
Key dates
External resources
