CVE-2019-11574: SSRF
Published Mar 20, 2020
·Updated
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.
Affected Software
1 affected component
SimpleMachines Simple Machine Forum<2.0.17
Event History
Mar 20, 2020
CVE Published
via MITRE·10:08 PM
Data Sourced
via MITRE·10:08 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-11574?
The severity of CVE-2019-11574 is critical.
2
How does CVE-2019-11574 affect Simple Machines Forum?
CVE-2019-11574 affects Simple Machines Forum versions up to and including 2.0.17.
3
What is SSRF?
SSRF stands for Server-Side Request Forgery, which allows an attacker to make requests on behalf of a vulnerable server.
4
How is user-supplied data used in CVE-2019-11574?
User-supplied data is used directly in curl calls in Subs-Package.php and Subs.php files, leading to SSRF vulnerabilities.
5
How can I fix CVE-2019-11574?
To fix CVE-2019-11574, you should update Simple Machines Forum to version 2.0.17 or later.