CVE-2024-1063

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1063
Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.tenable.com/security/research/tra-2024-03 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*
History

05 Feb 2024, 18:25

Type Values Removed Values Added
First Time Appwrite appwrite
Appwrite
CPE cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*
References () https://www.tenable.com/security/research/tra-2024-03 - () https://www.tenable.com/security/research/tra-2024-03 - Third Party Advisory
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 7.5

30 Jan 2024, 14:18

Type Values Removed Values Added
Summary
  • (es) Appwrite &lt;= v1.4.13 se ve afectada por Server-Side Request Forgery (SSRF) a través del endpoint '/v1/avatars/favicon' debido a una solución incompleta de CVE-2023-27159.

30 Jan 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-30 10:15

Updated : 2024-02-05 18:25

NVD link : CVE-2024-1063

Mitre link : CVE-2024-1063

CVE.ORG link : CVE-2024-1063

JSON object : View

Products Affected

appwrite

  • appwrite
CWE
CWE-918

Server-Side Request Forgery (SSRF)