CVE-2021-32639CWE-918

Server-Side Request Forgery (SSRF) in emissary:emissary

High · published July 2, 2021

CVSS v3.1
7.2
EPSS
1%
Percentile
72.2
In the wild
Unconfirmed
What it is

Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01395 · 72.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-07-02T15:30Z
EPSS history
Timeline
  • 02 JUL 15:30Z
    Server-Side Request Forgery (SSRF) in emissary:emissary
    cvelistv5