Description

Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Remediation

References

https://github.com/microcks/microcks

https://github.com/orgs/microcks/discussions/892

https://gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826

Related Vulnerabilities

CVE-2021-21252 Vulnerability in npm package jquery-validation

CVE-2022-25758 Vulnerability in npm package scss-tokenizer

CVE-2021-3859 Vulnerability in maven package io.undertow:undertow-core

CVE-2021-21277 Vulnerability in maven package org.webjars.npm:angular-expressions

CVE-2023-28155 Vulnerability in npm package request

Severity

Critical

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Product Exploit Issue Tracking Third Party Advisory