This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.NEXTCHAT_CVE-2023-49785.NBINNextChat < 2.11.3 SSRF
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AI Score
Confidence
Low
EPSS
Percentile
18.3%
The remote host contains a torchserve version that is prior to 2.11.3. It is, therefore, affected by a Server Side Request Forgery vulnerability in the api/cors endpoint.
Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
Binary data nextchat_CVE-2023-49785.nbinRelated
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AI Score
Confidence
Low
EPSS
Percentile
18.3%