CVE-2018-14858

An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-08-02

Last modified

2024-08-05

Weaknesses

CWE-918

Affected products

• Icms (Icmsdev)

References

• https://github.com/idreamsoft/iCMS/issues/33