CVE-2024-10903 Broken Link Checker < 2.4.2 - Admin+ SSRF
Admin users can perform Server-Side Request Forgery attacks via unvalidated link URLs in the Broken Link Checker plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10903?
CVE-2024-10903 is a medium-severity server-side request forgery vulnerability in Unknown Broken Link Checker, published on 26 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
Weakness: CWE-918
Which versions are affected by CVE-2024-10903?
It affects 1 product.
Products include Managewp Broken Link Checker.
How do I fix CVE-2024-10903?
No fix has been published for CVE-2024-10903 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-10903 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10903 exists.
Other vulnerabilities in Unknown Broken Link Checker
- CVE-2023-23737 WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection
- CVE-2022-2438 Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization
- CVE-2019-16521 Cross-site scripting in n/a
- CVE-2019-17207 Cross-site scripting in n/a
- CVE-2022-3922 Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
Sources
Also known as GHSA-7jjg-gm2c-94v7.