ByteOS Network

Vulnerability Details :

CVE-2020-24148

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-07 Jul, 2021 | 13:39

Updated At-04 Aug, 2024 | 15:05

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:07 Jul, 2021 | 13:39

Updated At:04 Aug, 2024 | 15:05

▼CVE Numbering Authority (CNA)

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://wordpress.org/plugins/import-xml-feed/#developers	x_refsource_MISC
https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md	x_refsource_MISC

Hyperlink: https://wordpress.org/plugins/import-xml-feed/#developers

Resource:

x_refsource_MISC

Hyperlink: https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://wordpress.org/plugins/import-xml-feed/#developers	x_refsource_MISC x_transferred
https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md	x_refsource_MISC x_transferred

Hyperlink: https://wordpress.org/plugins/import-xml-feed/#developers

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:07 Jul, 2021 | 14:15

Updated At:10 Jul, 2021 | 14:28

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary	2.0	6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P

Type: Primary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Type: Primary

Version: 2.0

Base score: 6.4

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:P

CPE Matches

mooveagency>>import_xml_and_rss_feeds>>2.0.1

cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:2.0.1:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	nvd@nist.gov

CWE ID: CWE-918

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md	cve@mitre.org	Third Party Advisory
https://wordpress.org/plugins/import-xml-feed/#developers	cve@mitre.org	Release Notes Vendor Advisory

Hyperlink: https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://wordpress.org/plugins/import-xml-feed/#developers

Source: cve@mitre.org

Resource:

Release Notes

Vendor Advisory

Similar CVEs

7Records found

CVE-2024-38109

Matching Score-4

Assigner-Microsoft Corporation

View Details

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-9.1||CRITICAL

EPSS-7.10% / 91.15%

7 Day CHG~0.00%

Published-13 Aug, 2024 | 17:30

Updated-10 Jul, 2025 | 16:33

Azure Health Bot Elevation of Privilege Vulnerability

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Vendor-Microsoft Corporation

Product-azure_health_bot Azure Health Bot

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2020-13379

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.2||HIGH

EPSS-92.74% / 99.74%

7 Day CHG~0.00%

Published-03 Jun, 2020 | 18:41

Updated-04 Aug, 2024 | 12:18

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

Vendor-n/a Grafana Labs NetApp, Inc.Fedora Project openSUSE

Product-grafana e-series_performance_analyzer fedora backports_sle leap n/a

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2022-0671

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.38% / 58.84%

7 Day CHG~0.00%

Published-18 Feb, 2022 | 17:50

Updated-02 Aug, 2024 | 23:32

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

Vendor-n/a Red Hat, Inc.

Product-vscode-xml vscode-xml

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-24759

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-9.3||CRITICAL

EPSS-52.37% / 97.83%

7 Day CHG~0.00%

Published-05 Sep, 2024 | 16:30

Updated-06 Sep, 2024 | 13:06

MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

Vendor-mindsdb mindsdb mindsdb

Product-mindsdb mindsdb mindsdb

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2023-41054

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-8.2||HIGH

EPSS-0.79% / 72.93%

7 Day CHG~0.00%

Published-04 Sep, 2023 | 17:32

Updated-30 Sep, 2024 | 17:47

LibreY Server-Side Request Forgery (SSRF) vulnerability in image_proxy.php

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `image_proxy.php` file of LibreY before commit 8f9b9803f231e2954e5b49987a532d28fe50a627. This vulnerability allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks via the `url` parameter. Remote attackers can use the server as a proxy to send HTTP GET requests and retrieve information in the internal network. Remote attackers can also request the server to download large files or chain requests among multiple instances to reduce the performance of the server or even deny access from legitimate users. This issue has been addressed in https://github.com/Ahwxorg/LibreY/pull/31. LibreY hosters are advised to use the latest commit. There are no known workarounds for this vulnerability.

Vendor-Ahwx

Product-librey LibreY

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2025-30220

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-9.9||CRITICAL

EPSS-3.84% / 87.71%

7 Day CHG-4.80%

Published-10 Jun, 2025 | 15:16

Updated-26 Aug, 2025 | 16:10

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.

Vendor-geotools osgeo geoserver

Product-geoserver geotools geonetwork geoserver

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2020-24147

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.1||CRITICAL

EPSS-1.01% / 76.12%

7 Day CHG~0.00%

Published-07 Jul, 2021 | 13:39

Updated-04 Aug, 2024 | 15:05

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.

Vendor-xylusthemes n/a

Product-wp_smart_import n/a

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2020-24148

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs