CVE-2022-22702

Description

PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.

CVSS Version 3.1
CVSS Version 2.0

nvd
CVE ID: CVE-2022-22702
Base Score: 4.3
Base Severity: MEDIUM
Vector String:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Impact Score: 1.4
Exploitability Score: 2.8

nvd
CVE ID: CVE-2022-22702
Base Score: 4.0
Base Severity: MEDIUM
Vector String:AV:N/AC:L/Au:S/C:P/I:N/A:N

Refrence: NVD

Description​

Description