CVE-2021-25939 LOW

CVE-2021-25939: ArangoDB - Blind SSRF when Downloading Foxx Service from URL

Vendor Arangodb
Product arangodb
Weakness CWE-918 · SSRF
Published February 9, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

2.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.

Key dates

02Disclosure timeline

February 9, 2022 CVE published
September 16, 2024 Record updated