Artalk
Monthly
Unauthenticated server-side request forgery in Artalk versions before 2.10.1 lets remote attackers make the comment server fetch attacker-chosen URLs by submitting an anonymous comment to /api/v2/comments with page_key set to an internal or external address. The fetched resource's HTML title is then exposed through the public comment list, giving an attacker title-level read access to internal endpoints; the trigger is confined to deployments that perform automatic page-title fetching on comment submission, and the independent assessment rates the impact as limited-confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and vendor patches are available in the 2.10.1 release.
Unauthenticated server-side request forgery in Artalk versions before 2.10.1 lets remote attackers make the comment server fetch attacker-chosen URLs by submitting an anonymous comment to /api/v2/comments with page_key set to an internal or external address. The fetched resource's HTML title is then exposed through the public comment list, giving an attacker title-level read access to internal endpoints; the trigger is confined to deployments that perform automatic page-title fetching on comment submission, and the independent assessment rates the impact as limited-confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and vendor patches are available in the 2.10.1 release.