PT-2024-26507 · Linkstack · Linkstack

Published 2024-11-29 · Updated 2025-07-03 · CVE-2024-35451

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LinkStack versions 2.7.9 through 4.7.7

Description The issue is a Server-Side Request Forgery (SSRF) vulnerability. It affects the resourcesviewscomponentsfavicon.blade.php file, allowing it to be linked with SSRF. This vulnerability poses a risk of local network compromise.

Recommendations For versions 2.7.9 through 4.7.7, patch immediately to resolve the SSRF vulnerability. Additionally, check logs for potential exploits and limit public access to the favicon.blade.php file if the patch cannot be applied immediately. As a temporary workaround, consider restricting access to the resourcesviewscomponentsfavicon.blade.php file until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-35451

Affected Products

Linkstack

References · 8

• 🔥 https://datafarm.co.th/blog/CVE-2024-35451:-From-%28Authenticated%29-SSRF-to-Remote-Code-Execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-35451 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35451 · Vendor Advisory
• https://twitter.com/oktsec/status/1862385423688835555 · Twitter Post
• https://t.me/cvenotify/102826 · Telegram Post
• https://t.me/cvenotify/127522 · Telegram Post
• https://twitter.com/CVEnew/status/1862359604958531676 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1862419164029128720 · Twitter Post