CVE-2018-1999017: SSRF
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appears to be exploitable via the attacker gaining access to an administrative account, enters a URL into Upgrade Engine, and reloads the page or presses "Check Now". This vulnerability appears to have been fixed in 8.2.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this Pydio vulnerability?
The vulnerability ID of this Pydio vulnerability is CVE-2018-1999017.
What is the severity level of CVE-2018-1999017?
The severity level of CVE-2018-1999017 is medium with a score of 4.9.
What is the affected software and version of CVE-2018-1999017?
The affected software and version of CVE-2018-1999017 is Pydio version 8.2.0 and earlier.
What is the description of CVE-2018-1999017?
CVE-2018-1999017 is a Server-Side Request Forgery (SSRF) vulnerability in Pydio plugins/action.updater/UpgradeManager.php that allows authenticated admin users to request arbitrary URLs and pivot requests through the server.
How can I fix CVE-2018-1999017?
To fix CVE-2018-1999017, you should update Pydio to the latest version (8.2.1 or later) that includes a security fix for this vulnerability.