CVE-2019-13020

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-26 · updated 2026-06-17
Weakness: CWE-918

Description

The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the browser have with the website and could serve malicious content from a third-party attacker-controlled system. Second, arguably more severe, is the potential for an attacker to circumvent firewall controls, by proxying traffic, unauthenticated, into the internal network from the internet.

Affected products

Trms Tightrope Media Carousel: before 7.1.3 — fixed in 7.1.3

How to fix

Upgrade to a fixed version: Trms Tightrope Media Carousel 7.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-13020 or the next vulnerability affects your stack