PT-2019-12163

CVE-2019-11066

·

Published

2019-05-10

·

Updated

2019-05-13

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions LightOpenID versions through 1.3.1
Description The issue allows for Server-Side Request Forgery (SSRF) via a crafted OpenID 2.0 assertion request using the HTTP GET method. This is related to the openid.php file in LightOpenID.
Recommendations For versions through 1.3.1, consider restricting access to the openid.php file to minimize the risk of SSRF exploitation until a patch is available.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2019-11066
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com