← voltar
CVE-2025-1447

kasuganosoras Pigeon index.php server-side request forgery

CVSS 5.3 MEDIUMEPSS 0.3%CWE-918
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
19 fev 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
kasuganosoras · Pigeon
Referências
https://github.com/kasuganosoras/Pigeon/commit/84cea5fe73141689da2e7ec8676d47435bd6423ehttps://github.com/kasuganosoras/Pigeon/releases/tag/1.0.181https://github.com/sheratan4/cve/issues/2https://vuldb.com/?ctiid.296134https://vuldb.com/?id.296134https://vuldb.com/?submit.501978