CVE-2017-20106

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-side request forgery. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Lithium	Forum	2017 Q1

References

https://vuldb.com/?id.97265Permissions Required, Third Party Advisory
https://www.vulnerability-lab.com/get_content.php?id=2030Exploit, Mitigation, Third Party Advisory
https://vuldb.com/?id.97265Permissions Required, Third Party Advisory
https://www.vulnerability-lab.com/get_content.php?id=2030Exploit, Mitigation, Third Party Advisory

Timeline

Published: Jun 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-201077.8A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The man CVE-2017-201085.4A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-ad CVE-2017-201096.5A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality CVE-2017-201107.5A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown fun CVE-2017-201119.8A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administra CVE-2017-201127.8A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functi CVE-2017-201135.4A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation lea CVE-2017-201145.4A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /CVE-2017-201155.4A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /ad CVE-2017-201165.4A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admi CVE-2017-201175.4A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functi CVE-2017-201185.4A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality o