CVE-2018-14858: SSRF
Published Aug 2, 2018
·Updated
An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spidertools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514.
Affected Software
1 affected component
icmsdev icms<7.0.11
Event History
Aug 2, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2018-14858.
2
What is the severity of CVE-2018-14858?
The severity of CVE-2018-14858 is high with a score of 7.5.
3
What is the affected software of CVE-2018-14858?
The affected software of CVE-2018-14858 is iCMS before V7.0.11.
4
What is the root cause of the vulnerability in CVE-2018-14858?
The root cause of the vulnerability in CVE-2018-14858 is that the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses.
5
How can I fix the vulnerability in CVE-2018-14858?
To fix the vulnerability in CVE-2018-14858, upgrade to iCMS version 7.0.11 or later.