Newspaper4K
Monthly
Server-side request forgery in newspaper4k through 0.9.6 lets an unauthenticated remote attacker who can influence a page processed by an integrating application cause the Image Extractor to fetch image or meta-refresh URLs pointing at loopback, link-local, private, or internal hosts. The impact is limited to confidentiality - limited internal response content may be exposed - with no integrity or availability effect, and the supplied CVSS 4.0 score is 6.9. The vendor fixed the issue in 0.9.6.1; no public exploit identified at time of analysis.
Server-side request forgery in newspaper4k through 0.9.6 lets an unauthenticated remote attacker who can influence a page processed by an integrating application cause the Image Extractor to fetch image or meta-refresh URLs pointing at loopback, link-local, private, or internal hosts. The impact is limited to confidentiality - limited internal response content may be exposed - with no integrity or availability effect, and the supplied CVSS 4.0 score is 6.9. The vendor fixed the issue in 0.9.6.1; no public exploit identified at time of analysis.