CVE-2024-43989 WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability
Unauthenticated attackers can exploit SSRF in Justified Image Grid to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43989?
CVE-2024-43989 is a high-severity server-side request forgery vulnerability in Firsh Justified Image Grid, published on 22 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.
Weakness: CWE-918
Which versions are affected by CVE-2024-43989?
How do I fix CVE-2024-43989?
No fix has been published for CVE-2024-43989 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-43989 being exploited?
There is no known exploitation of CVE-2024-43989 in the wild and no public exploit code.
Sources
Also known as GHSA-7w2x-xg3m-6rhw.