Description (CNA)
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| BookStack / BookStack | affected 23.10.2 |
CWE
CWE-918
References
- https://fluidattacks.com/advisories/imagination/
- https://www.bookstackapp.com/blog/bookstack-release-v23-10-3/
ADP enrichment
No English description supplied.