Vulnerabilities > CVE-2018-12571 - Server-Side Request Forgery (SSRF) vulnerability in Microsoft Forefront Unified Access Gateway 2010

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
microsoft
CWE-918
NVD
Published: 2018-07-05
Updated: 2018-09-04

Summary

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome.

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/148389/msforefront-dnsforge.txt
idPACKETSTORM:148389
last seen2018-07-03
published2018-07-02
reporterOkan Coskun
sourcehttps://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html
titleMicrosoft Forefront Unified Access Gateway 2010 External DNS Interaction

References