NetSight
IP …
medium5.5Known exploitedPublic exploit code

CVE-2016-3718

ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux For Ibm Z Systems
Versions 6.0_s390x, 7.0_s390x
RedhatEnterprise Linux For Ibm Z Systems Eus
Versions 6.7_s390x, 7.2_s390x, 7.3_s390x, 7.4_s390x, 7.5_s390x, 7.6_s390x
RedhatEnterprise Linux For Power Big Endian
Versions 6.0_ppc64, 7.0_ppc64
RedhatEnterprise Linux For Power Big Endian Eus
Versions 6.7_ppc64, 7.2_ppc64, 7.3_ppc64, 7.4_ppc64, 7.5_ppc64, 7.6_ppc64
RedhatEnterprise Linux For Power Little Endian
Version 7.0_ppc64le
RedhatEnterprise Linux For Power Little Endian Eus
Versions 7.2_ppc64le, 7.3_ppc64le, 7.4_ppc64le, 7.5_ppc64le, 7.6_ppc64le, 7.7_ppc64le
RedhatEnterprise Linux Hpc Node
Versions 6.0, 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.2
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6, 7.7

Weakness classification

CWE-918

References