CVE-2021-32639

2021-07-0216:15:08

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.9%

JSON

Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the RegisterPeerAction endpoint and the AddChildDirectoryAction endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.

CPENameOperatorVersion
emissaryeq5.10.0
emissaryeq5.6.0
emissaryeq5.7.0
emissaryeq5.1.0
emissaryeq5.8.0
emissaryeq5.2.0
emissaryeq5.3.0
emissaryeq5.9.0
emissaryeq5.4.1
emissaryeq6.1.0

Name	Operator	Version
emissary	eq	5.10.0
emissary	eq	5.6.0
emissary	eq	5.7.0
emissary	eq	5.1.0
emissary	eq	5.8.0
emissary	eq	5.2.0
emissary	eq	5.3.0
emissary	eq	5.9.0
emissary	eq	5.4.1
emissary	eq	6.1.0

Rows per page:

1-10 of 171

References

github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/AddChildDirectoryAction.java

github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/RegisterPeerAction.java

github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-2p8j-2rf3-h4xr