Vulnerability · Published Aug 25, 2020 · Assigned by twcert
CVE-2020-17386Cellopoint CelloOS - Server-Side Request Forgery (SSRF)
Medium 6.5
In plain English
A medium-severity server-side request forgery in CelloOS from Cellopoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 34.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cellopoint | CelloOS | 0 – through v4.1.10 Build 20190922 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html x_refsource_MISC