CVE-2017-7553

The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://access.redhat.com/errata/RHSA-2017:2674
https://access.redhat.com/errata/RHSA-2017:2675
https://bugzilla.redhat.com/show_bug.cgi?id=1478792	Issue Tracking Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2674
https://access.redhat.com/errata/RHSA-2017:2675
https://bugzilla.redhat.com/show_bug.cgi?id=1478792	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:mobile_application_platform:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:32

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/errata/RHSA-2017:2674 -~~	() https://access.redhat.com/errata/RHSA-2017:2674 -
References	~~() https://access.redhat.com/errata/RHSA-2017:2675 -~~	() https://access.redhat.com/errata/RHSA-2017:2675 -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1478792 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1478792 - Issue Tracking, Third Party Advisory

Information

Published : 2017-09-29 01:34

Updated : 2024-11-21 03:32

NVD link : CVE-2017-7553

Mitre link : CVE-2017-7553

CVE.ORG link : CVE-2017-7553

JSON object : View

Products Affected

redhat

mobile_application_platform

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2017-7553", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2017-09-29T01:34:50.407", "references": [{"url": "https://access.redhat.com/errata/RHSA-2017:2674", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2675", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2674", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2675", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints."}, {"lang": "es", "value": "La llamada api external_request en App Studio (millicore) permite que se realicen ataques de tipo Server Side Request Forgery (SSRF). Un atacante podr\u00eda aprovechar este fallo para sondear los recursos internos de la red y acceder a puntos de conexi\u00f3n restringidos."}], "lastModified": "2024-11-21T03:32:09.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:mobile_application_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E67D227E-8AAE-4C87-8318-B6E465CA44CF", "versionEndIncluding": "4.4.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}