CVE-2023-32750: SSRF
Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32750?
CVE-2023-32750 has a medium severity rating due to the potential for server-side request forgery (SSRF) attacks.
How do I fix CVE-2023-32750?
To fix CVE-2023-32750, upgrade Pydio Cells to version 4.1.3 or later.
What types of attacks are possible with CVE-2023-32750?
CVE-2023-32750 can be exploited to perform SSRF attacks, allowing attackers to access internal services.
Which versions of Pydio Cells are affected by CVE-2023-32750?
CVE-2023-32750 affects Pydio Cells versions from 4.1.0 to 4.1.2.
Is CVE-2023-32750 remotely exploitable?
Yes, CVE-2023-32750 is remotely exploitable due to its nature of allowing HTTP GET requests to arbitrary URLs.