Description

imgproxy allows an unauthenticated attacker to send arbitrary requests to perform lookups on the internal network which is otherwise not accessible externally. An attacker may use this feature to perform SSRF (server-side request forgery) attacks on the server.

Remediation

Upgrade to the latest version of imgproxy

References

imgproxy is vulnerable to Server-Side Request Forgery

CVE-2023-30019: SSRF in imgproxy<=3.14.0

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-17920)

Telerik Web UI Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2014-2217)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4588)

Jenkins Observable Discrepancy Vulnerability (CVE-2022-34174)

Oracle JRE CVE-2019-2962 Vulnerability (CVE-2019-2962)

Severity

Medium

Classification

CVE-2023-30019 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Tags

Acumonitor SSRF Known Vulnerabilities