Lucene search

GoogleOSV:CVE-2023-27162

HistoryMar 31, 2023 - 8:15 p.m.

CVE-2023-27162

2023-03-3120:15:07

Google

osv.dev

cve-2023-27162

server-side request forgery

network resources access

sensitive information

crafted api request

software

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.3%

JSON

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

CPENameOperatorVersion
openapi-generatoreq4.0.0
openapi-generatoreq3.0.3
openapi-generatoreq5.3.0
openapi-generatoreq3.0.2
openapi-generatoreq5.1.0
openapi-generatoreqswagger-codegen_2.9.1-2.0.1
openapi-generatoreq5.0.0
openapi-generatoreq2.3.0
openapi-generatoreq2.3.1
openapi-generatoreq6.2.1

Name	Operator	Version
openapi-generator	eq	4.0.0
openapi-generator	eq	3.0.3
openapi-generator	eq	5.3.0
openapi-generator	eq	3.0.2
openapi-generator	eq	5.1.0
openapi-generator	eq	swagger-codegen_2.9.1-2.0.1
openapi-generator	eq	5.0.0
openapi-generator	eq	2.3.0
openapi-generator	eq	2.3.1
openapi-generator	eq	6.2.1

Rows per page:

1-10 of 731

References

openapi-generator.com

gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08

github.com/OpenAPITools/openapi-generator

notes.sjtu.edu.cn/s/2_yki_2Xq

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.3%

JSON

Related for OSV:CVE-2023-27162