CVE-2017-14323

Опубликовано: 10 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter.

Ссылки

http://seclists.org/fulldisclosure/2018/Apr/16
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/16
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:onethink:onethink:1.0:*:*:*:*:*:*:*

cpe:2.3:a:onethink:onethink:1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.0695

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-cvpq-jx4g-whh2