CVE-2023-39110: SSRF
Published Aug 1, 2023
·Updated
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Affected Software
1 affected component
rConfig rConfig=3.9.4
Event History
Aug 1, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2023-39110?
CVE-2023-39110 refers to a Server-Side Request Forgery (SSRF) vulnerability in rconfig v3.9.4.
2
How does the vulnerability in rconfig v3.9.4 work?
The vulnerability allows authenticated attackers to make arbitrary requests by injecting crafted URLs through the path parameter in /ajaxGetFileByPath.php.
3
What is the severity of CVE-2023-39110?
The severity of CVE-2023-39110 is high with a CVSS score of 8.8.
4
What software version is affected by CVE-2023-39110?
rconfig v3.9.4 is affected by CVE-2023-39110.
5
How can I fix CVE-2023-39110?
To fix CVE-2023-39110, it is recommended to update rconfig to a version that addresses the SSRF vulnerability.