Lucene search

GoogleOSV:GHSA-9XC9-XQ7W-VPCR

HistoryJan 31, 2024 - 9:30 a.m.

Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability

2024-01-3109:30:18

Google

osv.dev

apache

servicecomb

vulnerability

ssrf

server-side

request

upgrade

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

38.5%

JSON

Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially crafted requests.This issue affects Apache ServiceComb before 2.1.0 (included). Users are recommended to upgrade to version 2.2.0, which fixes the issue.

References

www.openwall.com/lists/oss-security/2024/01/31/4

github.com/apache/servicecomb-service-center

lists.apache.org/thread/kxovd455o9h4f2v811hcov2qknbwld5r

nvd.nist.gov/vuln/detail/CVE-2023-44313