SSRF in AdmirorFrames Joomla! Extension
Priority LOW 38CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01227 69th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed AdmirorFrames (Nikola Vasilijevski): 5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nikola Vasilijevski | AdmirorFrames | before 5.0 | 5.0 | Patch available | CNA |
- AdmirorFrames VendorNikola Vasilijevski Affected before 5.0 Fixed in 5.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:admiror-design-studio:admirorframes:*:*:*:*:*:joomla\!:*:* | before 5.0 | Vulnerable | Nikola Vasilijevski |
- cpe:2.3:a:admiror-design-studio:admirorframes:*:*:*:*:*:joomla\!:*:* Versions before 5.0 Vulnerable ·Nikola Vasilijevski
Remediation
- Fix · CNA AdmirorFrames (Nikola Vasilijevski) Fixed in 5.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Nikola Vasilijevski AdmirorFrames 5.0
3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-05329 Full Path Disclosure in AdmirorFrames Joomla! ExtensionPriority HIGH 67
- TI-2024-05331 HTML Injection in AdmirorFrames Joomla! ExtensionPriority MEDIUM 61
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5736
References
More Nikola Vasilijevski Admirorframes vulnerabilities
- TI-2024-05329 Full Path Disclosure in AdmirorFrames Joomla! Extension CVSS 4.0MEDIUM 6.3
- TI-2024-05331 HTML Injection in AdmirorFrames Joomla! Extension CVSS 4.0MEDIUM 6.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences