CVE-2019-12161

2019-05-1719:29:00

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.0%

JSON

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).

CPENameOperatorVersion
webpagetesteqWebPageTest-17.12
webpagetesteqWebPagetest-2.12
webpagetesteq18.09
webpagetesteqWebPageTest-2.17
webpagetesteq18.09.1
webpagetesteqWebPagetest-2.14
webpagetesteqWebPageTest-3.0
webpagetesteq18.08
webpagetesteqWebPagetest-2.15
webpagetesteqstable

Name	Operator	Version
webpagetest	eq	WebPageTest-17.12
webpagetest	eq	WebPagetest-2.12
webpagetest	eq	18.09
webpagetest	eq	WebPageTest-2.17
webpagetest	eq	18.09.1
webpagetest	eq	WebPagetest-2.14
webpagetest	eq	WebPageTest-3.0
webpagetest	eq	18.08
webpagetest	eq	WebPagetest-2.15
webpagetest	eq	stable

Rows per page:

1-10 of 171

References

bugzilla.mozilla.org/show_bug.cgi?id=1550366