ByteOS Network

NVD Vulnerability Details :

CVE-2019-7652

Analyzed

Source-cve@mitre.org

Published At-09 May, 2019 | 21:29

Updated At-13 May, 2019 | 13:40

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.7	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

thehive-project>>cortex-analyzers>>Versions before 1.15.2(exclusive)

cpe:2.3:a:thehive-project:cortex-analyzers:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html	cve@mitre.org	Third Party Advisory
https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/	cve@mitre.org	Release Notes Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History