Lucene search

Veracode Vulnerability DatabaseVERACODE:44588

HistoryDec 07, 2023 - 6:07 a.m.

Server-Side Request Forgery (SSRF)

2023-12-0706:07:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

server-side request forgery

microcks

vulnerability

network resources

sensitive information

get request

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

30.5%

JSON

Microcks is vulnerable to Server-Side Request Forgery (SSRF). The vulnerability is due to the /jobs and /artifact/download components, which allow an attacker to access network resources and sensitive information via a crafted GET request, resulting in SSRF…

CPENameOperatorVersion
microcks apple1.8.1-M1
microcks apple1.8.1-M1

CPE	Name	Operator	Version
	microcks app	le	1.8.1-M1
	microcks app	le	1.8.1-M1

References

gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826

github.com/advisories/GHSA-gqj2-324p-vx73

github.com/microcks/microcks

github.com/orgs/microcks/discussions/892

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

30.5%

JSON

Related for VERACODE:44588