CVE-2023-45152

Katalog CVE

CVSS 2.3 · Low EPSS 0,30%

Kerentanan Server-Side Request Forgery (SSRF) pada engelsystem. Skor CVSS 3.1 2.3 (Low) menurut NVD.

Deskripsi (NVD)

Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.

Rincian

Terbit di NVD

17 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295 patch
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf exploit · advisory pihak ketiga