CVE-2021-32698CWE-918

Blind Server-Side Request Forgery (SSRF) in eLabFTW

Medium · published June 21, 2021

CVSS v3.1
6.8
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00936 · 60.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-06-21T21:15Z
EPSS history
Timeline
  • 21 JUN 21:15Z
    Blind Server-Side Request Forgery (SSRF) in eLabFTW
    cvelistv5