GitHub Advisoryadvisory · Maven

GHSA-hhxh-qphc-v423 Nepxion Discovery vulnerable to potential Information Disclosure due to Server-Side Request Forgery

MEDIUM Published 2022-09-25 Modified 2022-09-28 Official page ↗
Aliases
CVE-2022-23464
Ecosystem
Maven
Packages
com.nepxion:discovery
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-09-28

Affected packages

• Maven com.nepxion:discovery: <= 6.16.2 (no fix yet)

Description

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-23464 Nepxion Discovery is a solution for Spring Cloud. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References