CVE-2020-27197

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Server-Side Request Forgery (SSRF) pada eclecticiq opentaxii, libtaxii project libtaxii. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.

Rincian

Terbit di NVD

17 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/159662/Libtaxii-1.1.117-OpenTaxi-0.2.0-Server-Side-Request-Forgery.html exploit · advisory pihak ketiga
• https://github.com/TAXIIProject/libtaxii/issues/246 exploit · advisory pihak ketiga
• https://github.com/eclecticiq/OpenTAXII/issues/176 exploit · advisory pihak ketiga