Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-25939

Опубликовано: 09 фев. 2022
Источник: redhat
CVSS3: 2.7
EPSS Низкий

Описание

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat build of Quarkusio.quarkus.platform-quarkus-platform-configNot affected
Red Hat Integration Camel K 1org.apache.camel-camelNot affected
Red Hat Integration Camel K 1org.apache.camel.quarkus-camel-quarkusNot affected
Red Hat Integration Camel Quarkus 1org.apache.camel-camelNot affected
Red Hat Integration Camel Quarkus 1org.apache.camel.quarkus-camel-quarkusNot affected
Red Hat Integration Data Virtualisation Operatororg.apache.camel-camelNot affected
Red Hat Integration Data Virtualisation Operatororg.apache.camel.quarkus-camel-quarkusNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-918
https://bugzilla.redhat.com/show_bug.cgi?id=2053269ArangoDB: Blind SSRF via Foxx service download

EPSS

Процентиль: 46%
0.00234
Низкий

2.7 Low

CVSS3

Связанные уязвимости

CVSS3: 2.7
nvd
почти 4 года назад

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.

CVSS3: 2.7
debian
почти 4 года назад

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature whi ...

github
почти 4 года назад

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.

EPSS

Процентиль: 46%
0.00234
Низкий

2.7 Low

CVSS3