Server-Side Request Forgery in UReport · CVE-2020-21122 · GitHub Advisory Database · GitHub

Server-Side Request Forgery in UReport

High severity GitHub Reviewed Published Sep 20, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

com.bstek.ureport:ureport2-console (Maven)

Affected versions

<= 2.2.9

Patched versions

None

Description

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.

References

Published by the National Vulnerability Database

Sep 15, 2021

Reviewed Sep 16, 2021

Published to the GitHub Advisory Database Sep 20, 2021

Last updated Feb 1, 2023