CVE-2023-24243 : CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request For

CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).

Published 2023-06-16 17:15:12

Updated 2023-06-27 01:41:09

Source MITRE

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Products affected by CVE-2023-24243

Cdata » ARC
Versions before (<) 22.0.8473
cpe:2.3:a:cdata:arc:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

3.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: nvd@nist.gov (Primary)

https://arc.cdata.com/trial/

Free Trial - CData Arc
Product
https://gist.github.com/d3vc0r3/6460a5f006e32a2ebffe739e411ab1b8

Server-Side Request Forgery (SSRF) vulnerablity in CData Arc/API/Sync <= v22.0.8336 · GitHub
Exploit
https://www.cdata.com/kb/entries/netembeddedserver-notice.rst

Embedded Web Server (.NET) - Potential Medium Security Vulnerability
Vendor Advisory
https://arc.cdata.com/

CData Arc- Secure Data Integration & Managed File Transfer (MFT)
Product

Jump to