PT-2022-18822 · Unknown · Navigate Cms

Published 2022-04-28 · Updated 2023-12-29 · CVE-2022-28117

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Navigate CMS version 2.9.4

Description A Server-Side Request Forgery (SSRF) in the feed parser class allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

Recommendations For Navigate CMS version 2.9.4, consider disabling the feed parser class until a patch is available to prevent exploitation of the SSRF issue. Restrict access to the feed parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-28117

Affected Products

Navigate Cms

References · 16

• 🔥 https://github.com/cheshireca7/CVE-2022-28117 · Exploit
• 🔥 http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html · Exploit
• 🔥 https://youtube.com/watch?v=4kHW95CMfD0 · Exploit
• 🔥 https://exploit-db.com/exploits/50921 · Exploit
• https://osv.dev/vulnerability/CVE-2022-28117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28117 · Security Note
• https://navigatecms.com/en/blog/development/navigate_cms_update_2_9_5 · Vendor Advisory
• https://twitter.com/PentestingN/status/1740271925669355894 · Twitter Post
• https://twitter.com/TheHackForce/status/1740681044691452004 · Twitter Post
• https://t.me/cvenotify/29822 · Telegram Post
• https://t.me/cvenotify/30066 · Telegram Post
• https://t.me/cibsecurity/41584 · Telegram Post
• https://twitter.com/ksg93rd/status/1740063717742793164 · Twitter Post
• https://t.me/pentestingnews/25240 · Telegram Post
• https://t.me/cybersecuritytechnologies/6317 · Telegram Post