CVE-2020-21122 Server-Side Request Forgery in UReport

What is CVE-2020-21122?

CVE-2020-21122 is a medium-severity server-side request forgery vulnerability in n/a, published on 15 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.

Weakness: CWE-918

Which versions are affected by CVE-2020-21122?

2 open source packages ship an affected version, including com.bstek.ureport:ureport2-console. It affects 1 product.

Products include Ureport Project Ureport.

How do I fix CVE-2020-21122?

No fix has been published for CVE-2020-21122 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-21122 being exploited?

There is no known exploitation of CVE-2020-21122 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-21124 Missing authorization in n/a Critical 9.8
• CVE-2020-21125 Remote code execution in UReport Critical 9.8
• CVE-2023-24188 Arbitrary file deletion in ureport Critical 9.1
• CVE-2023-24187 XML External Entity Reference in ureport High 7.8
• CVE-2023-48848 ureport arbitrary file read vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6q3p-36f4-cwxv.