CVE-2024-25181

{
  "id": "CVE-2024-25181",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-29T20:15:40.423",
  "lastModified": "2026-10-27T18:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the \"file_get_contents\" function within the \"save.php\" file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad crítica ha sido identificada en givanz VvvebJs 1.7.2, que permite tanto la falsificación de petición del lado del servidor (SSRF) como la lectura arbitraria de archivos. La vulnerabilidad se origina en el manejo inadecuado de URLs proporcionadas por el usuario en la función ’file_get_contents’ dentro del archivo ’save.php’."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-30T15:14:51.536813Z",
          "id": "CVE-2024-25181",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vvveb:vvvebjs:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.7.4",
              "matchCriteriaId": "37982B87-A2D0-491F-AA7C-5C61A27FB225"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}