PT-2020-7514
CVE-2013-4864
·
تاريخ النشر
2020-01-28
·
تاريخ التحديث
2020-02-04
الوصف من
CVSS 2.0
7.5
عاليةالمقاييسAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions:
MiCasaVerde VeraLite version 1.5.408
Description:
The issue allows remote attackers to send HTTP requests to intranet servers via the
url parameter to "cgi-bin/cmh/proxy.sh", related to a Server-Side Request Forgery (SSRF) issue. This means an attacker can trick the server into making requests to internal resources that are not exposed to the external network.Recommendations:
For MiCasaVerde VeraLite version 1.5.408, as a temporary workaround, consider restricting access to the "cgi-bin/cmh/proxy.sh" endpoint to minimize the risk of exploitation. Avoid using the
url parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.قابلية الاستغلال
استغلال
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾