Описание
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
Ссылки
EPSS
Процентиль: 18%
0.00257
Низкий
7.7 High
CVSS3
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 7.7
github
7 дней назад
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
EPSS
Процентиль: 18%
0.00257
Низкий
7.7 High
CVSS3
Дефекты
CWE-918