PT-2019-13943 · Pydio · Pydio

Published 2019-09-19 · Updated 2019-09-20 · CVE-2019-15033

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pydio version 6.0.8

Description The issue allows for Authenticated Server-Side Request Forgery (SSRF) during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to "index.php" when sending a file to a remote server. This is demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.

Recommendations For Pydio version 6.0.8, as a temporary workaround, consider restricting access to the "index.php" endpoint or avoid using the file parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-15033

Affected Products

Pydio

References · 5

• 🔥 https://heitorgouvea.me/2019/09/17/CVE-2019-15033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15033 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15033 · Vendor Advisory
• https://pydio.com · Note
• https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel · Note