Server side request forgery (ssrf)

2009-05-2716:30:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.4%

JSON

agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field.

CPENameOperatorVersion
certificate_systemeq7.3

CPE	Name	Operator	Version
	certificate_system	eq	7.3

References

secunia.com/advisories/35242

secunia.com/advisories/35263

www.redhat.com/support/errata/RHSA-2009-1065.html

www.securityfocus.com/bid/35104

www.securitytracker.com/id?1022278

bugzilla.redhat.com/show_bug.cgi?id=484828

bugzilla.redhat.com/show_bug.cgi?id=488706