Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

CRITIQUE 9.8CVE-2023-48910 · GHSA-gqj2-324p-vx73 · Published 04/12/2023 · updated 17/06/2026

En bref

CVE-2023-48910 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant io.github.microcks:microcks, microcks (microcks).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.1% des vulnérabilités.
Correctif : mettre à jour vers 1.17.1 ou plus récent.

Package	Affected versions	Patched versions
io.github.microcks:microcks Maven	`< 1.17.1`	`1.17.1`
microcks microcks	`≤ 1.17.1`	No fix yet

Description

Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

NVD description

Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

References

nvd.nist.gov/vuln/detail/CVE-2023-48910 · ADVISORY
gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826 · WEB
microcks/microcks · PACKAGE
orgs/microcks · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free