PT-2026-136177
CVE-2026-121420
·
تاريخ النشر
2026-11-03
·
تاريخ التحديث
2026-11-03
الوصف من
CVSS 3.1
3.3
منخفضةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is private ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾