CVE-2019-4741 Server-side request forgery in Content Navigator

What is CVE-2019-4741?

CVE-2019-4741 is a medium-severity server-side request forgery vulnerability in IBM Content Navigator, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 172815.

Weakness: CWE-918

Which versions are affected by CVE-2019-4741?

It affects 1 product.

Products include Ibm Content Navigator.

How do I fix CVE-2019-4741?

No fix has been published for CVE-2019-4741 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-4741 being exploited?

There is no known exploitation of CVE-2019-4741 in the wild and no public exploit code.

Other vulnerabilities in IBM Content Navigator

• CVE-2018-1364 XML external entity in Content Navigator High 8.2
• CVE-2018-1366 Other in Content Navigator High 7.8
• CVE-2022-43581 IBM Content Navigator code execution High 7.5
• CVE-2019-4092 Open redirect in Content Navigator Medium 6.8
• CVE-2021-29714 Denial of service in Content Navigator Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g7r6-6487-7hm5.