Extension Kitodo Presentation
Monthly
Server-side request forgery in the TYPO3 extension Kitodo.Presentation allows unauthenticated remote attackers to make the web server issue arbitrary HTTP requests through the extension's public URL-fetching proxy endpoint, because one HTTP request method skips the authorization check that guards the other methods. The attacker controls the target URL and receives back the resulting status code and a limited set of response headers, which is enough to probe internal hosts and ports and map reachable services, though response bodies are explicitly not returned. Scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low confidentiality impact), the flaw is trivially triggerable by remote attackers who can reach the endpoint; no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in the TYPO3 extension Kitodo.Presentation allows unauthenticated remote attackers to make the web server issue arbitrary HTTP requests through the extension's public URL-fetching proxy endpoint, because one HTTP request method skips the authorization check that guards the other methods. The attacker controls the target URL and receives back the resulting status code and a limited set of response headers, which is enough to probe internal hosts and ports and map reachable services, though response bodies are explicitly not returned. Scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low confidentiality impact), the flaw is trivially triggerable by remote attackers who can reach the endpoint; no public exploit code or confirmed active exploitation was identified at time of analysis.