Description

imgproxy allows an unauthenticated attacker to send arbitrary requests to perform lookups on the internal network which is otherwise not accessible externally. An attacker may use this feature to perform SSRF (server-side request forgery) attacks on the server.

Remediation

Upgrade to the latest version of imgproxy

References

imgproxy is vulnerable to Server-Side Request Forgery

CVE-2023-30019: SSRF in imgproxy<=3.14.0

Related Vulnerabilities

SAP IGS XXE (CVE-2018-2392, CVE-2018-2393)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-14175)

Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10003)

XOOPS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3822)

Oracle Database Server CVE-2015-4888 Vulnerability (CVE-2015-4888)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Tags

Acumonitor SSRF Known Vulnerabilities CWE-918 CVE-2023-30019