CVE-2022-23464CWE-918

Potential Server Side Request Forgery (SSRF) in Nepxion Discovery

Medium · published September 24, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00732 · 53.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-09-24T04:40Z
EPSS history
Timeline
  • 24 SEP 04:40Z
    Potential Server Side Request Forgery (SSRF) in Nepxion Discovery
    cvelistv5