Vulnerability · Published Jan 31, 2024 · Assigned by apache

CVE-2023-44313Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API

High 7.6

In plain English

A high-severity server-side request forgery in Apache ServiceComb Service-Center from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)3.5%top 10.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially crafted requests.This issue affects Apache ServiceComb before 2.1.0(include). Users are recommended to upgrade to version 2.2.0, which fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/apache/servicecomb-service-center	2.2.0	GHSA-9xc9-xq7w-vpcr
Go	github.com/apache/servicecomb-service-center	no fix listed	GO-2024-2495

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache ServiceComb Service-Center	0 – through 2.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References