Server side request forgery (ssrf)

2019-05-1719:29:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.0%

JSON

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).

CPENameOperatorVersion
webpagetesteq19.04

CPE	Name	Operator	Version
	webpagetest	eq	19.04

References

bugzilla.mozilla.org/show_bug.cgi?id=1550366