CVE-2022-31196

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Server-Side Request Forgery (SSRF) pada databasir. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.

Rincian

Terbit di NVD

2 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vran-dev/databasir/commit/226c20e0c9124037671a91d6b3e5083bd2462058 patch · advisory pihak ketiga
• https://github.com/vran-dev/databasir/releases/tag/v1.0.7 release notes · advisory pihak ketiga
• https://github.com/vran-dev/databasir/security/advisories/GHSA-qvg8-427f-852q exploit · advisory pihak ketiga