PT-2022-18373 · Gibbon · Gibbon

Phosphore · Published 2022-04-25 · Updated 2022-05-05 · CVE-2022-27311

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gibbon versions 3.4.3 and below

Description The issue allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. This means an attacker can trick the server into making requests to arbitrary URLs, potentially leading to unauthorized access or data leakage.

Recommendations For Gibbon versions 3.4.3 and below, update to a version above 3.4.3 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-27311

GHSA-VX9G-377X-XWXQ

Affected Products

Gibbon

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gibbon/CVE-2022-27311.yml · Exploit
• https://github.com/amro/gibbon/commit/b2eb99ed304d7491a6d348a5bbdc83a008fc6e0b · Patch
• https://github.com/amro/gibbon/commit/cade20ca2438cd1b182dad70cbb77fb895779d10 · Patch
• https://github.com/amro/gibbon/pull/321 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-27311 · Security Note
• https://osv.dev/vulnerability/GHSA-vx9g-377x-xwxq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27311 · Vendor Advisory
• https://github.com/amro/gibbon · Note
• https://github.com/amro/gibbon/pull/321#issuecomment-1113147155 · Note
• https://t.me/cibsecurity/41378 · Telegram Post