CVE-2020-17386CWE-918

Cellopoint CelloOS - Server-Side Request Forgery (SSRF)

Medium · published August 25, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01098 · 65.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2020-08-25T07:35Z
EPSS history
Timeline
  • 25 AUG 07:35Z
    Cellopoint CelloOS - Server-Side Request Forgery (SSRF)
    cvelistv5