critical10.0
CVE-2019-10686
Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo
Impact
An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via `/system-info/health` because the `%23` substring is mishandled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.ctrip.framework.apollo:apollo | <= 1.3.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ctrip | Apollo | through 1.3.0 |