Vulnerabilities > CVE-2019-19835 - Server-Side Request Forgery (SSRF) vulnerability in Ruckuswireless Unleashed and Zonedirector 1200 Firmware

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

ruckuswireless

CWE-918

NVD

Published: 2020-01-23

Updated: 2020-01-27

Summary

SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.

Vulnerable Configurations

Part	Description	Count
OS	Ruckuswireless Ruckuswireless Unleashed * Ruckuswireless Zonedirector 1200 Firmware - Ruckuswireless Zonedirector 1200 Firmware 9.10.2.0.11 Ruckuswireless Zonedirector 1200 Firmware 9.10.2.0.53 Ruckuswireless Zonedirector 1200 Firmware 9.12.0 Ruckuswireless Zonedirector 1200 Firmware 9.12.3.0.28 Ruckuswireless Zonedirector 1200 Firmware 9.12.3.0.83 Ruckuswireless Zonedirector 1200 Firmware 9.13.0 Ruckuswireless Zonedirector 1200 Firmware 9.13.3.0.22 Ruckuswireless Zonedirector 1200 Firmware 9.13.3.0.145 Ruckuswireless Zonedirector 1200 Firmware 10.0.1.0.17 Ruckuswireless Zonedirector 1200 Firmware 10.0.1.0.44 Ruckuswireless Zonedirector 1200 Firmware 10.1.0 Ruckuswireless Zonedirector 1200 Firmware 10.1.0.0.1515 Ruckuswireless Zonedirector 1200 Firmware 10.2.0 Ruckuswireless Zonedirector 1200 Firmware 10.3.0	16
Hardware	Ruckuswireless Ruckuswireless C110 - Ruckuswireless E510 - Ruckuswireless H320 - Ruckuswireless H510 - Ruckuswireless M510 - Ruckuswireless R310 - Ruckuswireless R320 - Ruckuswireless R510 - Ruckuswireless R610 - Ruckuswireless R710 - Ruckuswireless R720 - Ruckuswireless T310 - Ruckuswireless T610 - Ruckuswireless T710 - Ruckuswireless Zonedirector 1200 -	15

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References