Lucene search

[email protected]CVE-2021-29357

HistoryApr 12, 2021 - 7:15 p.m.

CVE-2021-29357

2021-04-1219:15:14

CWE-918

[email protected]

web.nvd.nist.gov

cve-2021-29357

ect provider

outsystems platform server

ssrf

http requests

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.

Affected configurations

NVD

Node

outsystemslifetime_management_consoleRange11–11.7.0

outsystemsoutsystemsRange10–10.0.1104.0

outsystemsplatform_serverRange11–11.9.0

CPENameOperatorVersion
outsystems:lifetime_management_consoleoutsystems lifetime management consolelt11.7.0
outsystems:outsystemsoutsystemslt10.0.1104.0
outsystems:platform_serveroutsystems platform serverlt11.9.0

CPE	Name	Operator	Version
outsystems:lifetime_management_console	outsystems lifetime management console	lt	11.7.0
outsystems:outsystems	outsystems	lt	10.0.1104.0
outsystems:platform_server	outsystems platform server	lt	11.9.0

References

labs.integrity.pt/advisories/cve-2021-29357/

success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RTAF-2226

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

Related for CVE-2021-29357

prion1 cvelist1 nvd1