CVE-2021-23718

Опубликовано: 22 нояб. 2021

Источник: nvd

CVSS3: 6.5

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

Ссылки

https://github.com/welefen/ssrf-agent/blob/cec2b85fe8886ad6926a247a3e059d8369ec022b/index.js%23L13
Broken Link
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211203-0005/
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362
Exploit
Third Party Advisory
https://github.com/welefen/ssrf-agent/blob/cec2b85fe8886ad6926a247a3e059d8369ec022b/index.js%23L13
Broken Link
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211203-0005/
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ssrf-agent_project:ssrf-agent:*:*:*:*:*:node.js:*:*

Версия до 1.0.5 (исключая)

EPSS

Процентиль: 57%

0.00354

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-6gww-qpm6-mc2g

CVSS3: 6.5

github

около 4 лет назад

Server-Side Request Forgery in ssrf-agent

EPSS

Процентиль: 57%

0.00354

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918