CVE-2024-54330
Published: 13 December 2024
Summary
CVE-2024-54330 is a high-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-54330 is a Server-Side Request Forgery vulnerability affecting the Hurrakify WordPress plugin developed by hurraki. The flaw exists in all versions through 2.4 and is tracked under CWE-918. It received a CVSS 3.1 score of 7.2 with a network attack vector, low complexity, no required privileges or user interaction, and changed scope that permits limited confidentiality and integrity impacts.
An unauthenticated remote attacker can send crafted requests that cause the affected plugin to issue arbitrary server-side requests. Successful exploitation allows the attacker to interact with internal or external resources reachable by the WordPress server, potentially disclosing limited internal data or performing limited unauthorized actions within the changed security scope.
The vulnerability is documented in the Patchstack database, which lists the affected plugin versions and provides the associated CVE entry for further reference by administrators and defenders. The current EPSS score of 0.7253 indicates notable exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52453
Vulnerability details
Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.