Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.
References
Configurations
No configuration.
History
21 Nov 2024, 08:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://blueking.com - | |
| References | () http://tencent.com - | |
| References | () https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09 - | |
| References | () https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4 - |
05 Aug 2024, 21:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CWE | CWE-918 |
26 Feb 2024, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-26 16:27
Updated : 2024-11-21 08:56
NVD link : CVE-2024-22873
Mitre link : CVE-2024-22873
CVE.ORG link : CVE-2024-22873
JSON object : View
Products Affected
No product.
CWE
CWE-918
Server-Side Request Forgery (SSRF)