Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells.
References
| Link | Resource |
|---|---|
| https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/ | Exploit Third Party Advisory |
| https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses | Third Party Advisory |
| https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/ | Exploit Third Party Advisory |
| https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/ - Exploit, Third Party Advisory | |
| References | () https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - Third Party Advisory |
16 Jun 2023, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - Third Party Advisory | |
| References | (MISC) https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/ - Exploit, Third Party Advisory | |
| CWE | CWE-918 | |
| CPE | cpe:2.3:a:pydio:cells:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
08 Jun 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-08 21:15
Updated : 2025-01-06 21:15
NVD link : CVE-2023-32750
Mitre link : CVE-2023-32750
CVE.ORG link : CVE-2023-32750
JSON object : View
Products Affected
pydio
- cells
CWE
CWE-918
Server-Side Request Forgery (SSRF)