CVE-2021-23718 MEDIUM

CVE-2021-23718: Server-side Request Forgery (SSRF)

Vendor N/A
Product ssrf-agent
Published November 22, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P

What the vulnerability does

01Description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

Key dates

02Disclosure timeline

November 22, 2021 CVE published
September 16, 2024 Record updated