CVE-2019-7652
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-7652
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7652.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-7652
- Published
- 2019-05-09T21:29:07Z
- Modified
- 2024-09-03T02:57:28.742519Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.
- References
Affected packages
Git / github.com/thehive-project/cortex-analyzers
Affected ranges
- Type
- GIT
- Repo
- https://github.com/thehive-project/cortex-analyzers
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.0.0
1.1.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.11.0
1.12.0
1.13.0
1.13.1
1.13.2
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.1
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.4
1.5.0
1.5.1
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.7.1
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7