CVE-2022-23464
Potential Server Side Request Forgery (SSRF) in Nepxion Discovery
概要
Potential Server Side Request Forgery (SSRF) in Nepxion Discovery
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Maven
com.nepxion:discovery
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.16.2"}]}]
参照URL
- advisory nvd.nist.gov
- advisory securitylab.github.com
- advisory github.com
- advisory securitylab.github.com
- package github.com