GitHub Advisoryadvisory · Packagist

GHSA-hxgx-584x-vwm8 Appwrite Server-Side Request Forgery vulnerability

HIGH Published 2023-03-31 Modified 2023-04-10 Official page ↗
Aliases
CVE-2023-27159
Ecosystem
Packagist
Packages
appwrite/server-ce
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2023-04-10

Affected packages

• Packagist appwrite/server-ce: <= 1.2.1 (no fix yet)

Description

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component `/v1/avatars/favicon`. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Related

Alias · CVE (1)

  • CVE-2023-27159 Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References