PT-2022-16006 · Nepxion · Nepxion Discovery

Jorge Rosillo + 1 · Published 2022-09-24 · Updated 2022-09-28 · CVE-2022-23464

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nepxion Discovery (affected versions not specified)

Description The issue is related to a potential Server-Side Request Forgery (SSRF) in Nepxion Discovery, a solution for Spring Cloud. Specifically, the RouterResourceImpl uses RestTemplate's getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There are no known workarounds or patches available for this issue at the time of publication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-23464

GHSA-HHXH-QPHC-V423

Affected Products

Nepxion Discovery

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23464.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery · Exploit
• https://osv.dev/vulnerability/GHSA-hhxh-qphc-v423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23464 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23464 · Vendor Advisory
• https://github.com/Nepxion/Discovery · Note
• https://t.me/cvenotify/36792 · Telegram Post
• https://t.me/cvenotify/36781 · Telegram Post