Vulnerabilities > CVE-2022-22702 - Server-Side Request Forgery (SSRF) vulnerability in Partkeepr

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

partkeepr

CWE-918

NVD

Published: 2022-01-10

Updated: 2022-01-19

Summary

PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.

Vulnerable Configurations

Part	Description	Count
Application	Partkeepr Partkeepr Partkeepr 0.1 Partkeepr Partkeepr 0.1.1 Partkeepr Partkeepr 0.1.2 Partkeepr Partkeepr 0.1.3 Partkeepr Partkeepr 0.1.4 Partkeepr Partkeepr 0.1.5 Partkeepr Partkeepr 0.1.6 Partkeepr Partkeepr 0.1.6.1 Partkeepr Partkeepr 0.1.7 Partkeepr Partkeepr 0.1.8 Partkeepr Partkeepr 0.1.9 Partkeepr Partkeepr 0.11 Partkeepr Partkeepr 0.11A Partkeepr Partkeepr 0.16 Partkeepr Partkeepr 0.75 Partkeepr Partkeepr 0.76 Partkeepr Partkeepr 0.77 Partkeepr Partkeepr 0.78 Partkeepr Partkeepr 0.79 Partkeepr Partkeepr 0.80 Partkeepr Partkeepr 0.81 Partkeepr Partkeepr 0.82 Partkeepr Partkeepr 1.0.0 Partkeepr Partkeepr 1.1.0 Partkeepr Partkeepr 1.2.0 Partkeepr Partkeepr 1.3.0 Partkeepr Partkeepr 1.4.0	30

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References