Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2021-25939

ArangoDB - Blind SSRF when Downloading Foxx Service from URL

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mend

Description

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

arangodb arangodb

  • v3.7.0 to < unspecifiedaffected
  • unspecified to ≤ v3.9.0-alpha.1affected

References