{"id":"CVE-2018-15895","published":"2018-08-27T04:00:00Z","modified":"2024-08-05T10:10:04Z","title":"An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in…","vendor":null,"product":null,"tier":"tail","description":{"text":"An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01489,"percentile":0.73983,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/idreamsoft/iCMS/issues/40","tags":["x_refsource_MISC"]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":14.8}]},"euvd":{"id":"EUVD-2018-7751","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2018-14514-family-cve-2018-14514","parents":[{"from":"CVE-2018-14858","to":"CVE-2018-15895","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.","from":"CVE.org","in":"CVE-2018-15895"}]}]}}