CVE-2023-27162

Опубликовано: 31 мар. 2023

Источник: nvd

CVSS3: 9.1

EPSS Низкий

Описание

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

Ссылки

http://openapi-generator.com
Product
https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08
Third Party Advisory
https://github.com/OpenAPITools/openapi-generator
Product
https://notes.sjtu.edu.cn/s/2_yki_2Xq
Exploit
Third Party Advisory
http://openapi-generator.com
Product
https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08
Third Party Advisory
https://github.com/OpenAPITools/openapi-generator
Product
https://notes.sjtu.edu.cn/s/2_yki_2Xq
Exploit
Third Party Advisory
https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*

Версия до 6.4.0 (включая)

EPSS

Процентиль: 33%

0.00131

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-wg4w-5m5r-w3p8