PT-2019-13943 · Pydio · Pydio

Publicado 2019-09-19 · Atualizado 2019-09-20 · CVE-2019-15033

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pydio version 6.0.8

Description The issue allows for Authenticated Server-Side Request Forgery (SSRF) during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to "index.php" when sending a file to a remote server. This is demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.

Recommendations For Pydio version 6.0.8, as a temporary workaround, consider restricting access to the "index.php" endpoint or avoid using the file parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-15033

Produtos afetados

Pydio

Referências · 5

• 🔥 https://heitorgouvea.me/2019/09/17/CVE-2019-15033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15033 · Nota de Segurança
• https://pydio.com · Nota
• https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel · Nota
• https://osv.dev/vulnerability/CVE-2019-15033 · Aviso do Fabricante