CVE-2018-12571

Опубликовано: 05 июл. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome.

Ссылки

http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7
Exploit
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1041212
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7
Exploit
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1041212
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:microsoft:forefront_unified_access_gateway:2010:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.11402

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-rcm8-cg2r-pcq3