Server-side Request Forgery (SSRF) Affecting kitodo/presentation package, versions <2.3.2 >=3.0.0, <3.2.3 >=3.3.0, <3.3.4
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-KITODOPRESENTATION-2407280
- published 20 Feb 2022
- disclosed 20 Feb 2022
- credit Kajetan Dvoracek, Alexander Bigga
Introduced: 20 Feb 2022
CVE-2022-24980 Open this link in a new tabHow to fix?
Upgrade kitodo/presentation to version 2.3.2, 3.2.3, 3.3.4 or higher.
Overview
kitodo/presentation is a Base plugins, modules, services and API of the Digital Library Framework. It is part of the community-based Kitodo Digitization Suite.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via missing access check in an eID script. Unauthenticated users are able to submit arbitrary URLs to this component, allowing them to force the webserver to make requests on their behalf.
CVSS Scores
version 3.1