perfSONAR 4.4.4 Open Proxy / Relay...

- AV AC AU C I A
发布: 2022-11-30
修订: 2023-01-31

perfSONAR bundles with it a graphData.cgi script, used to graph and visualize data. There is a flaw in graphData.cgi allowing for unauthenticated users to proxy and relay HTTP/HTTPS traffic through the perfSONAR server. The vulnerability can potentially be leveraged to exfiltrate or enumerate data from internal web servers. This vulnerability was patched in perfSONAR version 4.4.5. Versions 4.x through 4.4.4 are affected. There is a whitelisting function that will mitigate, but is disabled by default.

0%
暂无可用Exp或PoC
当前有0条受影响产品信息