GitHub Advisoryadvisory · Maven

GHSA-hc94-9v26-gxwv Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

CRITICAL Published 2022-09-07 Modified 2022-09-16 Official page ↗

Aliases: CVE-2022-36663
Ecosystem: Maven
Packages: org.gluu:oxauth-common
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-918
Reviewed: 2022-09-16

Affected packages

• Maven org.gluu:oxauth-common: < 4.4.1 → fixed in 4.4.1

Description

Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.

Related

Alias · CVE (1)

CVE-2022-36663 Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter. vulnerability

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References