PT-2024-16423
CVE-2024-1063
·
Published
2024-01-30
·
Updated
2024-02-05
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Appwrite versions prior to v1.4.14
Description
The issue is related to a Server-Side Request Forgery (SSRF) that can be exploited via the "/v1/avatars/favicon" endpoint. This is due to an incomplete fix of a previously identified issue.
Recommendations
For versions prior to v1.4.14, update to version v1.4.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/v1/avatars/favicon" endpoint until a patch is applied.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾