Log in Start free

Actively exploited · Published May 5, 2016 · Assigned by redhat

CVE-2016-3718

Medium 5.5 Exploited

In plain English

A medium-severity server-side request forgery in ImageMagick from ImageMagick. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 75.6% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)75.6%top 0.5% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12graphicsmagick1.3.24-1DEBIAN-CVE-2016-3718
Debian:13graphicsmagick1.3.24-1DEBIAN-CVE-2016-3718
Debian:14graphicsmagick1.3.24-1DEBIAN-CVE-2016-3718
Debian:12imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3718
Debian:13imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3718
Debian:14imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3718

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-918 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References