CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

The CVE-2019-7652 affects TheHive Project’s UnshortenLink analyzer (pre-1.1) included in Cortex analyzers (pre-1.15.2). It enables SSRF via the Data parameter when selecting URL, allowing an attacker to supply an SSRF payload (for example, http://127.0.0.1:22) and observe results on the dashboard...

CVE-2019-7652: Server-Side Request Forgery (SSRF)

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

PT-2019-18683

Name of the Vulnerable Software and Affected Versions TheHive Project UnshortenLink analyzer versions prior to 1.1 Cortex-Analyzers versions prior to 1.15.2 Description The issue allows for Server-Side Request Forgery SSRF attacks. An attacker can exploit this by creating a new analysis, selectin...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

The vulnerability CVE-2018-20226 affects THEHIVE PROJECT Cortex up to version 2.1.3, caused by not overriding Role.toString. This enables an organization administrator to add a super administrator (privilege escalation). Exploitation details are not provided in the supplied documents. Remediation...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

PT-2018-15294

Name of the Vulnerable Software and Affected Versions THEHIVE PROJECT Cortex versions prior to 2.1.3 Description The issue arises from the lack of overriding the Role.toString method, allowing an organization administrator to add a super administrator. Recommendations For versions prior to 2.1.3,...

CVE-2018-20226: Undefined Security Weakness

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

Free Open Source Scalable Incident Response Platform: The Hive

Free Open Source Scalable Incident Response Platform TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHi...