Описание
A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.
Уязвимые конфигурации
Конфигурация 1Версия до 11.3.6 (исключая)Версия от 12.0.0 (включая) до 12.0.3 (исключая)
Одно из
cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 12%
0.00214
Низкий
8.5 High
CVSS3
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 8.5
github
около 1 месяца назад
A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.
EPSS
Процентиль: 12%
0.00214
Низкий
8.5 High
CVSS3
Дефекты
CWE-918