Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
Résumé
Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com