exploitDog

CVE-2022-43140

Опубликовано: 17 нояб. 2022

Источник: nvd

CVSS3: 7.5

EPSS Высокий

Описание

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.

Ссылки

https://github.com/kekingcn/kkFileView/issues/392
Exploit
Issue Tracking
Third Party Advisory
https://github.com/kekingcn/kkFileView/issues/392
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.79265

Высокий

7.5 High

CVSS3

Дефекты

CWE-918

CWE-918

Связанные уязвимости

GHSA-hxhg-m762-rjxh

CVSS3: 7.5

github

около 3 лет назад

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.

EPSS

Процентиль: 99%

0.79265

Высокий

7.5 High

CVSS3

Дефекты

CWE-918

CWE-918