CVE-2022-23071

Published: Jun 19, 2022Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.

Affected (1)

Products: Tandoor: Recipes

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tandoor Recipes	From 0.9.1 to 1.2.5

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c

Source: vulnerabilitylab@mend.io

PatchThird Party Advisory

https://www.mend.io/vulnerability-database/CVE-2022-23071

Source: vulnerabilitylab@mend.io

ExploitPatchThird Party Advisory

https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.mend.io/vulnerability-database/CVE-2022-23071

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.