{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-09-18T00:00:00", "descriptions": [{"lang": "en", "value": "The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-12-30T10:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2017:2674", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:2674"}, {"name": "RHSA-2017:2675", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:2675"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:04:12.023Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2017:2674", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:2674"}, {"name": "RHSA-2017:2675", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:2675"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2017-7553", "datePublished": "2017-09-28T20:00:00", "dateReserved": "2017-04-05T00:00:00", "dateUpdated": "2024-08-05T16:04:12.023Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:mobile_application_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "E67D227E-8AAE-4C87-8318-B6E465CA44CF", "versionEndIncluding": "4.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints."}, {"lang": "es", "value": "La llamada api external_request en App Studio (millicore) permite que se realicen ataques de tipo Server Side Request Forgery (SSRF). Un atacante podr\u00eda aprovechar este fallo para sondear los recursos internos de la red y acceder a puntos de conexi\u00f3n restringidos."}], "id": "CVE-2017-7553", "lastModified": "2024-11-21T03:32:09.227", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-29T01:34:50.407", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2674"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2675"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:2674"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:2675"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Tomas Rzepka for reporting this issue.", "affected_release": [{"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "fh-system-dump-tool-0:1.0.0-5.el7", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "fping-0:3.10-4.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "nagios-0:4.0.8-8.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "nagios-plugins-0:2.0.3-3.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "perl-Crypt-CBC-0:2.33-2.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "perl-Crypt-DES-0:2.05-20.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "perl-Net-SNMP-0:6.0.1-7.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "phantomjs-0:1.9.7-3.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "python-meld3-0:0.6.10-1.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "qstat-0:2.11-13.20080912svn311.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "radiusclient-ng-0:0.5.6-9.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "redis-0:2.8.21-2.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "rhmap-fh-openshift-templates-0:4.5.0-11.el7", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "rhmap-mod_authnz_external-0:3.3.1-7.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "sendEmail-0:1.56-2.el7", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "ssmtp-0:2.64-14.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2674", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "supervisor-0:3.1.3-3.el7map", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}, {"advisory": "RHSA-2017:2675", "cpe": "cpe:/a:redhat:mobile_application_platform:4.5", "package": "rhmap45/fh-aaa:1.0.5-12", "product_name": "Red Hat Mobile Application Platform 4.5", "release_date": "2017-09-18T00:00:00Z"}], "bugzilla": {"description": "RHMAP: SSRF via external_request feature of App Studio", "id": "1478792", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1478792"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-918", "details": ["The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.", "The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources and access restricted endpoints."], "name": "CVE-2017-7553", "public_date": "2017-09-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-7553\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-7553"], "threat_severity": "Moderate"}