CVE-2024-6784CWE-918

SSRF Server Side Request Forgery

High · published December 5, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

⚡ A sneaky Server-Side Request Forgery (SSRF) vulnerability could let an attacker access unauthorized resources on your network. That's right—this one's like leaving your front door wide open! Think of it like giving a delivery driver access to your personal files just because they have your address. If not controlled, they could peek into places they shouldn't be—like the security vault! With this vulnerability, an attacker could potentially gain access to sensitive information and resources, leading to severe data breaches. If exploited, it might allow them to snoop around your server and expose critical information you wanted to keep safe. Quite the recipe for disaster!

Put simply

Think of it like giving a delivery driver access to your personal files just because they have your address. If not controlled, they could peek into places they shouldn't be—like the security vault! This SSRF vulnerability allows unauthorized requests to be sent from the server, potentially leading to information disclosure and access to internal resources.

What to do

With this vulnerability, an attacker could potentially gain access to sensitive information and resources, leading to severe data breaches. If exploited, it might allow them to snoop around your server and expose critical information you wanted to keep safe. Quite the recipe for disaster! To protect yourself, immediately update to the latest versions of ABB ASPECT, NEXUS Series, and MATRIX Series. Additionally, restrict outgoing traffic and validate requests to ensure they only access allowed resources. Stay vigilant! You've got this! Follow these steps to secure your systems, and you'll be keeping those sneaky attackers at bay! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:N
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-12-05T12:25Z
EPSS history
Timeline
  • 05 DEC 12:25Z
    SSRF Server Side Request Forgery
    cvelistv5