PT-2021-19864 · Elabftw · Elabftw

Mgrraf + 3 · Published 2021-06-21 · Updated 2021-06-28 · CVE-2021-32698

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eLabFTW versions prior to 4.0.0

Description This issue affects an open source electronic lab notebook for research labs, allowing an attacker to make GET requests on behalf of the server. The attack is "blind" because the attacker cannot see the result of the request.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 to resolve the issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-32698

GHSA-MH6G-62P8-26M4

Affected Products

Elabftw

References · 5

• https://github.com/elabftw/elabftw/commit/3d2db4d3ad90b0915f29f05aeba41eaaf6a7c726 · Patch
• https://github.com/elabftw/elabftw/security/advisories/GHSA-mh6g-62p8-26m4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32698 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32698 · Vendor Advisory
• https://t.me/cibsecurity/25594 · Telegram Post