Vulnerabilities > CVE-2020-27197 - Server-Side Request Forgery (SSRF) vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

libtaxii-project

eclecticiq

CWE-918

critical

NVD

Published: 2020-10-17

Updated: 2024-11-21

Summary

TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.

Vulnerable Configurations

Part	Description	Count
Application	Libtaxii_Project Libtaxii Project Libtaxii 1.0.090 Libtaxii Project Libtaxii 1.0.100 Libtaxii Project Libtaxii 1.0.101 Libtaxii Project Libtaxii 1.0.102 Libtaxii Project Libtaxii 1.0.103 Libtaxii Project Libtaxii 1.0.104 Libtaxii Project Libtaxii 1.0.105 Libtaxii Project Libtaxii 1.0.106 Libtaxii Project Libtaxii 1.0.107 Libtaxii Project Libtaxii 1.1.100 Libtaxii Project Libtaxii 1.1.101 Libtaxii Project Libtaxii 1.1.102 Libtaxii Project Libtaxii 1.1.103 Libtaxii Project Libtaxii 1.1.104 Libtaxii Project Libtaxii 1.1.105 Libtaxii Project Libtaxii 1.1.106 Libtaxii Project Libtaxii 1.1.107 Libtaxii Project Libtaxii 1.1.108 Libtaxii Project Libtaxii 1.1.109 Libtaxii Project Libtaxii 1.1.110 Libtaxii Project Libtaxii 1.1.111 Libtaxii Project Libtaxii 1.1.112 Libtaxii Project Libtaxii 1.1.113 Libtaxii Project Libtaxii 1.1.114 Libtaxii Project Libtaxii 1.1.115 Libtaxii Project Libtaxii 1.1.116 Libtaxii Project Libtaxii 1.1.117	27
Application	Eclecticiq Eclecticiq Opentaxii 0.1.0 Eclecticiq Opentaxii 0.1.1 Eclecticiq Opentaxii 0.1.2 Eclecticiq Opentaxii 0.1.3 Eclecticiq Opentaxii 0.1.4 Eclecticiq Opentaxii 0.1.5 Eclecticiq Opentaxii 0.1.6 Eclecticiq Opentaxii 0.1.7 Eclecticiq Opentaxii 0.1.8 Eclecticiq Opentaxii 0.1.9 Eclecticiq Opentaxii 0.1.10 Eclecticiq Opentaxii 0.1.11 Eclecticiq Opentaxii 0.1.12 Eclecticiq Opentaxii 0.2.0	14

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References