Server side request forgery (ssrf)

2023-11-2909:15:00

PRIOn knowledge base

www.prio-n.com

server-side request forgery

esm

vulnerability

certificate validation

arbitrary content upload

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.2%

JSON

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn’t parse for invalid data

CPENameOperatorVersion
enterprise_security_managerlt11.6.8

CPE	Name	Operator	Version
	enterprise_security_manager	lt	11.6.8

References

kcm.trellix.com/corporate/index?page=content&id=SB10413