PT-2022-24700 · Unknown · Rava Certificate Validation System

Jay Wu + 1 · Published 2022-10-18 · Updated 2022-10-20 · CVE-2022-39055

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions RAVA certificate validation system (affected versions not specified)

Description The RAVA certificate validation system has inadequate filtering for the URL parameter, allowing an unauthenticated remote attacker to perform a Server-Side Request Forgery (SSRF) attack. This can enable the attacker to discover the internal network topology based on the query response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-39055

Affected Products

Rava Certificate Validation System

References · 4

• https://osv.dev/vulnerability/CVE-2022-39055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39055 · Security Note
• https://t.me/cibsecurity/51657 · Telegram Post
• https://twcert.org.tw/tw/cp-132-6616-9092f-1.html · Note