PT-2021-10835 · Halo · Halo

Jayway007 · Published 2021-07-12 · Updated 2021-07-12 · CVE-2020-23079

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Halo versions prior to 1.3.3

Description A Server-Side Request Forgery (SSRF) issue exists in the SMTP configuration of the affected software, allowing detection of the server intranet.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-23079

Affected Products

Halo

References · 3

• 🔥 https://github.com/halo-dev/halo/issues/806 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23079 · Security Note