CVE-2021-22255

2021-08-2018:15:07

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.9%

JSON

SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address.

CPENameOperatorVersion
baseroweq0.7.0
baseroweq0.8.0
baseroweq0.7.1
baseroweq0.6.0
baseroweq1.0.1
baseroweq1.0.0

Name	Operator	Version
baserow	eq	0.7.0
baserow	eq	0.8.0
baserow	eq	0.7.1
baserow	eq	0.6.0
baserow	eq	1.0.1
baserow	eq	1.0.0

References

baserow.io/blog/march-2021-release-of-baserow

gitlab.com/bramw/baserow/-/issues/370

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json