PT-2019-8311 · Thehive · Thehive

Name of the Vulnerable Software and Affected Versions: TheHive versions prior to 2.13.4 TheHive versions 3.x prior to 3.3.1 Description: An improper authorization check in the User API allows users with read-only or read/write access to escalate their privileges to the administrator's privileges...

Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

Exploit Title: Cortex Unshortenlink Analyzer 1.1 - Server-Side Request Forgery Date: 2/26/2019 Exploit Author: Alexandre Basquin Vendor Homepage: https://blog.thehive-project.org Software Link: https://github.com/TheHive-Project/Cortex Version: Cortex = 2.1.3 Tested on: 2.1.3 CVE : CVE-2019-7652...

TheHive Project Cortex < 1.15.2 - Server-Side Request Forgery Vulnerability

Exploit for multiple platform in category web applications Exploit Title: SSRF in TheHive Project Cortex = 2.1.3 Exploit Author: Alexandre Basquin Vendor Homepage: https://blog.thehive-project.org Software Link: https://github.com/TheHive-Project/Cortex Version: Cortex = 2.1.3 Tested on: 2.1.3 CV...

TheHive Project Cortex 2.1.3 Server Side Request Forgery

Exploit Title: SSRF in TheHive Project Cortex = 2.1.3 Date: 2/26/2019 Exploit Author: Alexandre Basquin Vendor Homepage: https://blog.thehive-project.org Software Link: https://github.com/TheHive-Project/Cortex Version: Cortex = 2.1.3 Tested on: 2.1.3 CVE : CVE-2019-7652 Exploit description TheHi...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

The CVE-2019-7652 affects TheHive Project’s UnshortenLink analyzer (pre-1.1) included in Cortex analyzers (pre-1.15.2). It enables SSRF via the Data parameter when selecting URL, allowing an attacker to supply an SSRF payload (for example, http://127.0.0.1:22) and observe results on the dashboard...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

CVE-2018-20226

The vulnerability CVE-2018-20226 affects THEHIVE PROJECT Cortex up to version 2.1.3, caused by not overriding Role.toString. This enables an organization administrator to add a super administrator (privilege escalation). Exploitation details are not provided in the supplied documents. Remediation...

CVE-2018-20226

An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method...

Free Open Source Scalable Incident Response Platform: The Hive

Free Open Source Scalable Incident Response Platform TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHi...