CVE-2022-39055

Changing Information Technology Inc. RAVA certificate validation system - Server-Side Request Forgery (SSRF)

CVSS 5.3 MEDIUMEPSS 0.4%CWE-918

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

18 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack to discover internal network topology base on query response.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Changing Information Technology Inc. · RAVA certificate validation system

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.twcert.org.tw/tw/cp-132-6616-9092f-1.html