High severity · published Dec 18, 2024
CVE-2024-55086
In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Getsimple Cms · Getsimple-ce
3.3.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-55086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-55086
Product
https://getsimple-ce.ovh/
Broken Link
https://tasteful-stamp-da4.notion.site/CVE-2024-55086-15b1e0f227cb80e4bf4ed76aac53f795
More from Getsimple Cms
9.8
CVE-2024-55085
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement…
8.8
CVE-2026-28495
GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
8.8
CVE-2025-48492
GetSimple CMS RCE in Edit component
8.8
CVE-2024-55088
GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module
7.5
CVE-2026-27202
GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability