PT-2024-25907 · Twonav · Twonav

Dddkiao · Published 2024-05-03 · Updated 2024-07-03 · CVE-2024-34453

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TwoNav version 2.1.13

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited via the url parameter to the API endpoint "index.php?c=api&method=read data&type=connectivity test", which ultimately reaches "/system/api.php".

Recommendations For TwoNav version 2.1.13, consider disabling access to the "index.php?c=api&method=read data&type=connectivity test" endpoint until a patch is available. Restrict the use of the url parameter in this endpoint to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-34453

Affected Products

Twonav

References · 6

• https://osv.dev/vulnerability/CVE-2024-34453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34453 · Security Note
• https://github.com/tznb1/TwoNav/issues/9#issuecomment-2022194939 · Note
• https://github.com/tznb1/TwoNav/compare/v2.1.13-20240321...v2.1.14-20240419 · Note
• https://twitter.com/VulmonFeeds/status/1786495684817903833 · Twitter Post
• https://twitter.com/CVEnew/status/1789348959737000142 · Twitter Post