CVEvulnerability

CVE-2020-13650

7.5 HIGH Published 2020-06-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-918

Description

An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that allows use of the application as a proxy. Sent to an external server, a forged request discloses application credentials. For a request to an internal component, the request is blind, but through the error message it's possible to determine whether the request targeted a open service.

Affected configurations

• digdash digdash 2018r2 • digdash digdash 2019r1 • digdash digdash 2019r2

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References