CVE-2023-6070CWE-918

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially…

Medium · published November 29, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-11-29T08:53Z
EPSS history
Timeline
  • 29 NOV 08:53Z
    A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially…
    cvelistv5