by Kastro
Paper/Archive/CVE-2023-3744

CVE-2023-3744

SLiMS SLiMS — Server-Side Request Forgery in SLiMS

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 46.3.463 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.

Affected

ProductAffectedFixed inSource
SLiMS9.6.0–CNA

Scores by source

INCIBE (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims