PT-2022-12569 · Unknown · Ligeo Archives Ligeo Basics

Published 2022-03-17 · Updated 2022-03-24 · CVE-2021-46107

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ligeo Archives Ligeo Basics as of 02 01-2022

Description The issue allows an attacker to read any documents via the download features due to Server Side Request Forgery (SSRF). This means an attacker can exploit the vulnerability to access sensitive information.

Recommendations For Ligeo Archives Ligeo Basics as of 02 01-2022, consider restricting access to the download features until a fix is available. As a temporary workaround, limit the ability to read documents via the download features to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-46107

Affected Products

Ligeo Archives Ligeo Basics

References · 5

• 🔥 https://raw.githubusercontent.com/Orange-Cyberdefense/CVE-repository/master/PoCs/POC_CVE-2021-46107.py · Exploit
• https://osv.dev/vulnerability/CVE-2021-46107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46107 · Security Note
• https://t.me/cibsecurity/39173 · Telegram Post
• https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29 · Note