CVE-2018-15895: SSRF

Q: What is the severity of CVE-2018-15895?

The severity of CVE-2018-15895 is high with a severity value of 7.5.

Q: What is the affected software of CVE-2018-15895?

The affected software of CVE-2018-15895 is iCMS 7.0.11.

Q: What is the Common Weakness Enumeration (CWE) of CVE-2018-15895?

The Common Weakness Enumeration (CWE) of CVE-2018-15895 is CWE-918.

Q: How can I fix the SSRF vulnerability in iCMS 7.0.11 (CVE-2018-15895)?

To fix the SSRF vulnerability in iCMS 7.0.11, apply the latest security patch or upgrade to a patched version of the software.

Q: Where can I find more information about CVE-2018-15895?

More information about CVE-2018-15895 can be found at the following reference: https://github.com/idreamsoft/iCMS/issues/40

Published Aug 27, 2018

Updated

An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spidertools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.

Affected Software

1 affected component

icmsdev icms<7.0.11

Remediation

Patch Available

https://github.com/idreamsoft/iCMS/issues/40

Event History

Aug 27, 2018

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2018-15895?

The severity of CVE-2018-15895 is high with a severity value of 7.5.

What is the affected software of CVE-2018-15895?