Veracode Vulnerability DatabaseVERACODE:6207DNS Rebinding
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
github.com/coreos/etcd is vulnerable to DNS rebinding. The vulnerability exists because it does not prevent the attacker to use its DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/coreos/etcd | eq | HEAD | |
| github.com/coreos/etcd | le | 3.2.30 | |
| github.com/coreos/etcd | le | 3.3.22 | |
| etcd:sid | eq | 3.3.25+dfsg-6 |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N