PT-2026-108623 · Pypi · Praisonai
Publicado
2026-07-10
·
Atualizado
2026-07-10
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4w49-gwv8-fpjg. This link is maintained to preserve external references.
Original Description
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Praisonai