Vulnerabilities > CVE-2017-12905 - Server-Side Request Forgery (SSRF) vulnerability in Vebto Pixie Image Editor 1.4/1.7

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
vebto
CWE-918
NVD
Published: 2017-09-25
Updated: 2017-10-06

Summary

Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.

Vulnerable Configurations

Part Description Count
Application
Vebto
2

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/144272/pixie-ssrf.txt
idPACKETSTORM:144272
last seen2017-09-24
published2017-09-20
reporterBeiJing Baimaohui Technology Co., LTD.
sourcehttps://packetstormsecurity.com/files/144272/Pixie-Image-Editor-1.7-Server-Side-Request-Forgery.html
titlePixie Image Editor 1.7 Server-Side Request Forgery

References