What is CVE-2022-24980?

CVE-2022-24980 is a high-severity vulnerability in Kitodo Kitodo.presentation, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2022-02-19.

How severe is CVE-2022-24980?

High severity. CVSS v3 base score is 7.5 out of 10.

SSRF in Kitodo Kitodo.presentation

CVE-2022-24980

An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.012 (65.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Kitodo Kitodo.presentation
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-24980?: CVE-2022-24980 is a high-severity vulnerability in Kitodo Kitodo.presentation, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2022-02-19.
How severe is CVE-2022-24980?: High severity. CVSS v3 base score is 7.5 out of 10.