Wegow
Monthly
Server-side request forgery in Wegow's ticket sales chart PDF export allows an authenticated promoter to inject malicious SVG content into the export request, causing the third-party Highcharts cloud service to fetch attacker-controlled external resources and embed the responses in the generated PDF. This provides a request proxying/laundering capability constrained to what the external SaaS can reach, and no public exploit has been identified at time of analysis. The CVSS 4.0 base score is 7.1 (High), driven almost entirely by high integrity impact (VI:H) while confidentiality and availability impacts are none, an unusual weighting for an SSRF which more typically carries a confidentiality impact.
Server-side request forgery in Wegow's ticket sales chart PDF export allows an authenticated promoter to inject malicious SVG content into the export request, causing the third-party Highcharts cloud service to fetch attacker-controlled external resources and embed the responses in the generated PDF. This provides a request proxying/laundering capability constrained to what the external SaaS can reach, and no public exploit has been identified at time of analysis. The CVSS 4.0 base score is 7.1 (High), driven almost entirely by high integrity impact (VI:H) while confidentiality and availability impacts are none, an unusual weighting for an SSRF which more typically carries a confidentiality impact.