CVE-2018-1000138

Опубликовано: 23 мар. 2018

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources.

Ссылки

https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/functions.php#L811
Third Party Advisory
https://github.com/mkucej/i-librarian/issues/120
Exploit
Issue Tracking
Third Party Advisory
https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/functions.php#L811
Third Party Advisory
https://github.com/mkucej/i-librarian/issues/120
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:scilico:i\,_librarian:*:*:*:*:*:*:*:*

Версия до 4.8 (включая)

EPSS

Процентиль: 44%

0.00212

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

CVE-2018-1000138

CVSS3: 9.1

debian

почти 8 лет назад

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in ...

GHSA-g3qf-pqh8-4q8m

CVSS3: 9.1

github

больше 3 лет назад

EPSS

Процентиль: 44%

0.00212

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-918