CVE-2025-1447

Feb. 19, 2025, 1:15 a.m.

4.3
Medium

Description

A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.

Product(s) Impacted

Product Versions
Pigeon
  • 1.0.177

Weaknesses

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

https://github.com/kasuganosoras/Pigeon/commit/84cea5fe73141689da2e7ec8676d47435bd6423e
https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.181
https://github.com/sheratan4/cve/issues/2
https://vuldb.com/?ctiid.296134
https://vuldb.com/?id.296134
https://vuldb.com/?submit.501978

Tags

cna@vuldb.com
CWE-918
2025-02-19
CVE-2025-1447

CVSS Score

4.3 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Date

  • Published: Feb. 19, 2025, 1:15 a.m.
  • Last Modified: Feb. 19, 2025, 1:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@vuldb.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.