The vulnerability of the implementation of the HTTP or FTP protocol in the console-based graphic editor ImageMagick allows a attacker to perform an SSRF attack.

🗓️ 25 Nov 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

ImageMagick HTTP or FTP handling flaw enables remote request forgery due to weak validation.

Reporter	Title	Published	Views	Family All 112
FreeBSD	ImageMagick -- multiple vulnerabilities	3 May 201600:00	–	freebsd
0day.today	ImageMagick 6.9.3-9 / 7.0.1-0 - Multiple Vulnerabilities (ImageTragick)	4 May 201600:00	–	zdt
ALT Linux	Security fix for the ALT Linux 7 package ImageMagick version 6.8.4.10-alt3.M70P.1	20 May 201600:00	–	altlinux
ATTACKERKB	CVE-2016-3718	5 May 201600:00	–	attackerkb
Amazon	Important: ImageMagick	11 May 201600:00	–	amazon
Tenable Nessus	Amazon Linux AMI : ImageMagick (ALAS-2016-699) (ImageTragick)	12 May 201600:00	–	nessus
Tenable Nessus	CentOS 6 / 7 : ImageMagick (CESA-2016:0726) (ImageTragick)	11 May 201600:00	–	nessus
Tenable Nessus	Debian DLA-1401-1 : graphicsmagick security update	28 Jun 201800:00	–	nessus
Tenable Nessus	Debian DLA-484-1 : graphicsmagick security update (ImageTragick)	24 May 201600:00	–	nessus
Tenable Nessus	Debian DLA-486-1 : imagemagick security update (ImageTragick)	23 May 201600:00	–	nessus

Vulners

Node

imagemagick_studio_llc imagemagickRange<6.9.3-10

OR

imagemagick_studio_llc imagemagickRange7.0–7.0.1-1

OR

novell suse_managerMatch2.1

OR

novell suse_manager_proxyMatch2.1

OR

novell suse_linux_enterprise_workstation_extensionMatch12

OR

novell suse_linux_enterprise_software_development_kitMatch12

OR

novell suse_linux_enterprise_debuginfoMatch11-sp3

OR

novell suse_linux_enterprise_debuginfoMatch11-sp4

OR

novell suse_openstack_cloudMatch5

OR

novell opensuseMatch13.2

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

canonical ubuntuMatch12.04

OR

novell opensuse_leapMatch42.1

OR

slackware_linux slackwareMatch14.0

OR

slackware_linux slackwareMatch14.1

OR

oracle solarisMatch10

OR

oracle solarisMatch11.3

OR

canonical ubuntuMatch15.10

OR

oracle oracle_linuxMatch7

OR

oracle oracle_linuxMatch6

OR

novell suse_linux_enterprise_desktopMatch12

OR

novell suse_linux_enterprise_serverMatch12

Source	Link
git	www.git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html
access	www.access.redhat.com/security/cve/cve-2016-3718
debian	www.debian.org/security/2016/dsa-3580
openwall	www.openwall.com/lists/oss-security/2016/05/03/18
oracle	www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

25 Nov 2021 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 37.4

EPSS0.76897

ImageMagick web protocol flaw remote forgery request validation