Vulnerabilities > CVE-2017-12905 - Server-Side Request Forgery (SSRF) vulnerability in Vebto Pixie - Image Editor 1.4/1.7

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
vebto
CWE-918
critical
NVD
Published: 2017-09-25
Updated: 2024-11-21

Summary

Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.

Vulnerable Configurations

Part Description Count
Application
Vebto
2

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/144272/pixie-ssrf.txt
idPACKETSTORM:144272
last seen2017-09-24
published2017-09-20
reporterBeiJing Baimaohui Technology Co., LTD.
sourcehttps://packetstormsecurity.com/files/144272/Pixie-Image-Editor-1.7-Server-Side-Request-Forgery.html
titlePixie Image Editor 1.7 Server-Side Request Forgery

References