{"id":"CVE-2024-25737","details":"A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.","aliases":["GHSA-fwhc-mm9q-mqq8"],"modified":"2026-08-12T03:51:33.017755494Z","published":"2024-05-22T19:05:25.776Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25737.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://vufind.org/wiki/security:cve-2024-25737"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25737.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25737"},{"type":"FIX","url":"https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b"},{"type":"FIX","url":"https://github.com/vufind-org/vufind/commit/51f2ddac0dc1047e6fd3b27e6d984b19e1601d00"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vufind-org/vufind","events":[{"introduced":"b47c6eb76c4e2e1e574f0249f129dfb5dc498b9c"},{"fixed":"c3ca18810bef5a91b231481c2e2ea994b5e3896b"},{"introduced":"0"},{"fixed":"c0e9bf429bc93881efa7c28fa7c7005c15d81d59"},{"fixed":"345d00f7d7f1c581f46742effdac70e803b3847b"},{"fixed":"51f2ddac0dc1047e6fd3b27e6d984b19e1601d00"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"2.4"},{"fixed":"9.1"},{"introduced":"0"},{"fixed":"9.1.1"}]}}],"versions":["v9.1","v8.0.1","v8.0","v7.0","v6.1","v6.0","v5.0","v4.1","v4.0","v3.1","v3.0","v2.3","v2.2","v2.1","v2.0","v2.0RC1","v2.0beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25737.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}