medium6.5
CVE-2022-23071
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality.
Impact
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tandoor | Recipes | from 0.9.1 through 1.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c
- https://www.mend.io/vulnerability-database/CVE-2022-23071
- https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c
- https://www.mend.io/vulnerability-database/CVE-2022-23071