|
Description: | | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. There is a probability of false positive in this rule. Because the vulnerability can not only forge the server to issue a request, but also directly read the local file of the server, it needs to be judged according to the specific hit situation. |
|
Impact: | | SSRF is a security vulnerability constructed by an attacker to form a request initiated by a server. By exploiting this vulnerability, an attacker can bypass access restrictions such as firewalls, thereby using an infected or vulnerable server as a proxy for port scanning and even accessing internal system data. |
|
Affected OS: | | Windows, Linux, Others |
|
Reference: | | https://github.com/zer0yu/CVE_Request/blob/master/rConfig/rConfig_path_b.md https://cxsecurity.com/cveshow/CVE-2023-39108/
|
|