CVE-2022-24862 Server-Side Request Forgery in Databasir
Attackers can exploit a JDBC driver download verification flaw to perform Server-Side Request Forgery, potentially accessing internal resources or sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24862?
CVE-2022-24862 is a high-severity server-side request forgery vulnerability in vran-dev databasir, published on 20 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the download verification process of a JDBC driver the corresponding JDBC driver download address will be downloaded first, but this address will return a response page with complete error information when accessing a non-existent URL. Attackers can take advantage of this feature for SSRF.
Weakness: CWE-918
Which versions are affected by CVE-2022-24862?
It affects 1 product.
Products include Databasir Project Databasir.
How do I fix CVE-2022-24862?
No fix has been published for CVE-2022-24862 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-24862 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24862 exists.
Other vulnerabilities in vran-dev databasir
Sources
Also known as GHSA-r8m9-r74j-vc6m.