CVE-2020-22002

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage…

published April 29, 2021

CVSS
—
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01352 · 71.3th percentile
Published
2021-04-29T14:22Z
EPSS history
Timeline
  • 29 APR 14:22Z
    An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage…
    cvelistv5