Threats tagged 'ghsa-3jxc-r5w9-wr42'

A Server-Side Request Forgery (SSRF) vulnerability exists in the /themes/{name}/upgrade-from-uri endpoint of halo version 2.22.14. This flaw allows authenticated attackers to send crafted GET requests that can scan internal resources. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.