CVE-2022-22702
PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be ma...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.
Références
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- report github.com