Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

CRITICO 9.8CVE-2023-48910 · GHSA-gqj2-324p-vx73 · Published 04/12/2023 · updated 17/06/2026

In breve

CVE-2023-48910 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda io.github.microcks:microcks, microcks (microcks).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.1% delle vulnerabilità.
Correzione: aggiornare a 1.17.1 o successiva.

Package	Affected versions	Patched versions
io.github.microcks:microcks Maven	`< 1.17.1`	`1.17.1`
microcks microcks	`≤ 1.17.1`	No fix yet

Description

Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

NVD description

Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

References

nvd.nist.gov/vuln/detail/CVE-2023-48910 · ADVISORY
gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826 · WEB
microcks/microcks · PACKAGE
orgs/microcks · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free