{"id":"GHSA-c3q8-hh69-7mg5","aliases":["CVE-2020-14044"],"title":"Codiad SSRF Vulnerability","description":"A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. **NOTE:** the vendor states \"Codiad is no longer under active maintenance by core contributors.\"","severity":"high","score":7.2,"published":"2022-05-24T17:26:24.000Z","modified":"2024-04-25T22:43:37.282Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"codiad/codiad","ranges":[{"events":[{"introduced":"1.7.8"},{"last_affected":"2.8.4"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-14044","https://github.com/Codiad/Codiad/issues/1122","https://github.com/Codiad/Codiad/issues/1132","https://advisory.checkmarx.net/advisory/CX-2020-4280","https://github.com/Codiad/Codiad"],"sources":[{"name":"OSV","id":"GHSA-c3q8-hh69-7mg5","modified":"2024-04-25T22:43:37.282377Z","url":"https://osv.dev/vulnerability/GHSA-c3q8-hh69-7mg5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}]}