CVE-2024-0946 is a high severity flaw (CVSS 7.3) in 60IndexPage. The record says the vendor did not respond, and no fixed version is listed. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
60IndexPage up to 1.8.5, the file /apply/index.php, argument url.
The record gives a CVSS base score of 7.3 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The weakness class is CWE-918.
The record scores this 7.3 High. It is a second SSRF in the same product as CVE-2024-0945, in a different file.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record says the vendor did not respond, and no fixed version is listed.
How to check if you're exposed
Check the installed version against 1.8.5. Review web logs for requests to /apply/index.php with unusual url values.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0946 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of 60IndexPage in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record says the vendor did not respond, and no fixed version is listed.
- Apply mitigations while you wait: restrict outbound requests from the host and block the endpoint if you cannot patch.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is server-side request forgery, CWE-918. The application takes a URL from a request and fetches it from the server side, so a caller can make the server contact addresses the caller could not reach directly, such as internal services.
SSRF matters most where the server can reach internal management interfaces or cloud metadata services. The standard defenses are an allow list of destinations, blocking private address ranges, and not returning raw fetched content to the caller.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
What limits SSRF impact?
An allow list of destinations and blocking server access to internal address ranges.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record says the vendor did not respond, and no fixed version is listed. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://note.zhaoj.in/share/iNSyaClT0hGi
- https://vuldb.com/?ctiid.252190
- https://vuldb.com/?id.252190
- Safeguard Gold record for CVE-2024-0946
Last reviewed: 19 October 2026.
