CVE-2022-28117

EPSS 22.9%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS —EPSS 22.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

06 Apr 2022Public PoC

28 Apr 2022Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

Affected products

n/a · n/a

public PoCs found — 4

githubgithub.com/cheshireca7/CVE-2022-28117★ 2 githubgithub.com/kimstars/POC-CVE-2022-28117★ 0 cve_referencepacketstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.htmlunverified exploitdbwww.exploit-db.com/exploits/50921unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5 https://www.youtube.com/watch?v=4kHW95CMfD0