CVE-2020-1925
CVE-2020-1925
Vexday Risk Score
3Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS —EPSS 2.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
09 jan 2020Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
Produtos afetados
Apache Software Foundation · Apache OlingoQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →