CVE-2024-25181

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de	Third Party Advisory
https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vvveb:vvvebjs:*:*:*:*:*:*:*:*

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad crítica ha sido identificada en givanz VvvebJs 1.7.2, que permite tanto la falsificación de petición del lado del servidor (SSRF) como la lectura arbitraria de archivos. La vulnerabilidad se origina en el manejo inadecuado de URLs proporcionadas por el usuario en la función ’file_get_contents’ dentro del archivo ’save.php’.

Information

Published : 2025-12-29 20:15

Updated : 2026-10-27 18:10

NVD link : CVE-2024-25181

Mitre link : CVE-2024-25181

CVE.ORG link : CVE-2024-25181

JSON object : View

Products Affected

vvveb

vvvebjs

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-25181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-25181", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-30T15:14:51.536813Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-29T20:15:40.423", "references": [{"url": "https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the \"file_get_contents\" function within the \"save.php\" file."}, {"lang": "es", "value": "Una vulnerabilidad cr\u00edtica ha sido identificada en givanz VvvebJs 1.7.2, que permite tanto la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) como la lectura arbitraria de archivos. La vulnerabilidad se origina en el manejo inadecuado de URLs proporcionadas por el usuario en la funci\u00f3n \u2019file_get_contents\u2019 dentro del archivo \u2019save.php\u2019."}], "lastModified": "2026-10-27T18:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vvveb:vvvebjs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37982B87-A2D0-491F-AA7C-5C61A27FB225", "versionEndIncluding": "1.7.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}