What is CVE-2018-1999017?

CVE-2018-1999017 is a medium-severity vulnerability in Pydio, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.9/10. Published 2018-07-23.

How severe is CVE-2018-1999017?

Medium severity. CVSS v3 base score is 4.9 out of 10.

SSRF in Pydio

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appears to be exploitable via the attacker gaining access to an administrative account, enters a URL into Upgrade Engine, and reloads the page or presses "Check Now". This vulnerability appears to have been fixed in 8.2.1.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.010 (58.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Pydio
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM, Patch, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2018-1999017?: CVE-2018-1999017 is a medium-severity vulnerability in Pydio, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.9/10. Published 2018-07-23.
How severe is CVE-2018-1999017?: Medium severity. CVSS v3 base score is 4.9 out of 10.