Описание
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.16.2 (включая)
cpe:2.3:a:nepxion:discovery:*:*:*:*:*:spring_cloud:*:*
EPSS
Процентиль: 30%
0.00112
Низкий
4.3 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
Nepxion Discovery vulnerable to potential Information Disclosure due to Server-Side Request Forgery
EPSS
Процентиль: 30%
0.00112
Низкий
4.3 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-918