CVE-2024-25738
CVE-2024-25738
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini.
CVSS 9.1 · Critical · EPSS 0.7% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
vufind/vufind Packagist
- Versions
- v2.0
- v2.0.1
- v2.1
- v2.1.1
- v2.2
- v2.2.1
- v2.3
- v2.3.1
- v2.4
- v2.4.1
- v2.5
- v2.5.1
- v2.5.2
- v2.5.3
- v2.5.4
- v3.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.1
- v3.1.1
- v3.1.2
- v3.1.3
- v3.1.4
- v4.0
- v4.0.1
- v4.1
- v4.1.1
- v4.1.2
- v4.1.3
- v5.0
- v5.0.1
- v5.1
- v5.1.1
- v6.0
- v6.0.1
- v6.1
- v6.1.1
- v6.1.2
- v7.0
- v7.0.1
- v7.0.2
- v7.1
- v7.1.1
- v8.0
- v8.0.1
- v8.0.2
- v8.0.3
- v8.0.4
- v8.1
- v8.1.1
- v8.1.2
- v9.0
- v9.0.1
- v9.0.2
- v9.0.3
- v9.1
- Affected ranges
- ECOSYSTEM: ≥ 2.0, < 9.1.1
Update to 9.1.1