VulnerabilityAnalyzed

CVE-2024-48107

SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF).

MEDIUM 6.5EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.23% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: sparkshop/sparkshop
Source: cve@mitre.org

References

https://gist.github.com/RMAX2000/ebb654016e5b8a5b55aa6d8a7f2f321a#file-cve-2024-48107Third Party Advisory
https://gitee.com/sparkshop/sparkshopProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.