What’s Vulnerable › Vulnerabilities

CVE-2017-20157: Ariadne Component Library Url.php server-side request forgery

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-31 · updated 2026-06-17
• Weakness: CWE-918

Description

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

Affected products

• Ariadne Component Library: before 3.0 — fixed in 3.0

How to fix

Upgrade to a fixed version: Ariadne Component Library 3.0. Check the vendor advisory for mitigations.

References

• https://github.com/Ariadne-CMS/arc-web/commit/1feb1cc11e6c9f218408f15f53f537ea0d788656
• https://github.com/Ariadne-CMS/arc-web/releases/tag/3.0
• https://vuldb.com/?ctiid.217140
• https://vuldb.com/?id.217140
• https://github.com/Ariadne-CMS/arc-web/commit/1feb1cc11e6c9f218408f15f53f537ea0d788656
• https://github.com/Ariadne-CMS/arc-web/releases/tag/3.0
• https://vuldb.com/?ctiid.217140
• https://vuldb.com/?id.217140

Get alerted when CVE-2017-20157 or the next vulnerability affects your stack