Lucene search

CVE-2024-21527

🗓️ 19 Jul 2024 05:10:15Reported by snykType

cve🔗 web.nvd.nist.gov👁 34 Views🌐 WEB

Versions of gotenberg package before 8.1.0 are vulnerable to SSRF via localhost. Attackers can achieve local file inclusion

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2024-21527	19 Jul 202405:00	–	cvelist
RedhatCVE	CVE-2024-21527	5 Feb 202511:00	–	redhatcve
Veracode	Server-Side Request Forgery (SSRF)	25 Jul 202408:20	–	veracode
OSV	CVE-2024-21527	19 Jul 202405:15	–	osv
OSV	GO-2024-2996 CVE-2024-21527 in github.com/gotenberg/gotenberg	22 Jul 202418:24	–	osv
Vulnrichment	CVE-2024-21527	19 Jul 202405:00	–	vulnrichment
NVD	CVE-2024-21527	19 Jul 202405:15	–	nvd

[
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/gotenberg",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/modules/chromium",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "github.com/gotenberg/gotenberg/v8/pkg/modules/webhook",
    "versions": [
      {
        "version": "0",
        "lessThan": "8.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESWEBHOOK-7537083
gist	www.gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGGOTENBERG-7537081
github	www.github.com/gotenberg/gotenberg/releases/tag/v8.1.0
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESCHROMIUM-7537082

Parameter	Position	Path	Description	CWE
src	query param	/convert/html	Server-side Request Forgery (SSRF) vulnerability allowing local file inclusion via localhost.	CWE-918

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

19 Jul 2024 05:15Current

6.7Medium risk

Vulners AI Score6.7

CVSS38.2

EPSS0.00074

SSVC

CWE-918