PT-2024-33045 · Mipjz · Mipjz

Lvzcho · Published 2024-10-25 · Updated 2024-10-29 · CVE-2024-48234

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mipjz version 5.0.5

Description An issue in the push method of apptagcontrollerApiAdminTag.php allows the postAddress parameter to be directly passed into curl exec execution and output without proper processing, resulting in a Server-side request forgery (SSRF) vulnerability. This vulnerability can be exploited to read server files.

Recommendations For mipjz version 5.0.5, as a temporary workaround, consider validating and sanitizing the postAddress parameter to prevent malicious input from being executed by curl exec. Restrict access to sensitive server files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-48234

Affected Products

Mipjz

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-48234 · Security Note
• https://github.com/sansanyun/mipjz/issues/18 · Note
• https://t.me/cvedetector/8994 · Telegram Post
• https://t.me/cvenotify/99575 · Telegram Post