Server Side Request Forgery (SSRF)

🗓️ 12 Feb 2024 12:14:01Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 116 Views

SSRF vulnerability due to misinterpretation of hexadecimal IP addresses in isPublic() function

Reporter	Title	Published	Views	Family All 79
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.2 addresses multiple security vulnerabilities	24 Apr 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM includes components with known vulnerabilities	12 Apr 202415:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana for Synthetic PoP is affected by Multiple Security Vulnerabilities	15 Mar 202413:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	15 Apr 202502:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion is vulnerable to arbitrary code execution due to Node.js IP package.	21 May 202416:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion HCI is vulnerable to arbitrary code execution due to Node.js IP package.	21 May 202416:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in ip	17 Dec 202510:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to SSRF due to ip for Node.js (CVE-2023-42282)	8 Aug 202414:25	–	ibm

Vulners

Node

node-ip node-ipMatch1.1.5-5debian

AND

debian debian_linuxMatch999

ip ipRange0.0.1–1.1.8js

ip ipMatch2.0.0js

webjars ipRange1.1.5–1.1.8js

webjars ipMatch2.0.0js

Source	Link
cosmosofcyberspace	www.cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
github	www.github.com/advisories/GHSA-78xj-cgh5-2h22
github	www.github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
huntr	www.huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
security	www.security.netapp.com/advisory/ntap-20240315-0008/
bleepingcomputer	www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/

04 Jul 2024 00:33Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.00652