Lucene search

MitreCVE-2017-14611

HistoryApr 10, 2018 - 3:29 p.m.

CVE-2017-14611

2018-04-1015:29:01

CWE-918

mitre

web.nvd.nist.gov

cve

2017

14611

ssrf

cockpit

server side request forgery

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.007

Percentile

79.8%

JSON

SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component.

Affected configurations

Nvd

Node

agentejocockpitMatch0.13.0

VendorProductVersionCPE
agentejocockpit0.13.0cpe:2.3:a:agentejo:cockpit:0.13.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
agentejo	cockpit	0.13.0	cpe:2.3:a:agentejo:cockpit:0.13.0:::::::*

References

seclists.org/fulldisclosure/2018/Apr/15

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.007

Percentile

79.8%

JSON

Related for CVE-2017-14611