Description (CNA)
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| aliyun / alibabacloud-dataworks-mcp-server | affected 1.0.0; affected 1.0.1; affected 1.0.2; affected 1.0.3; affected 1.0.4; affected 1.0.5; affected 1.0.6; affected 1.0.7; affected 1.0.8; affected 1.0.9; affected 1.0.10; affected 1.0.11; affected 1.0.12; affected 1.0.13; affected 1.0.14; affected 1.0.15; affected 1.0.16; affected 1.0.17; affected 1.0.18; affected 1.0.19; affected 1.0.20; affected 1.0.21; affected 1.0.22; affected 1.0.23; affected 1.0.24; affected 1.0.25; affected 1.0.26; affected 1.0.27; affected 1.0.28; affected 1.0.29; affected 1.0.30; affected 1.0.31; affected 1.0.32; affected 1.0.33; affected 1.0.34; affected 1.0.35; affected 1.0.36; affected 1.0.37; affected 1.0.38; affected 1.0.39; affected 1.0.40; affected 1.0.41; affected 1.0.42; affected 1.0.43 |
CWE
CWE-918
References
- https://vuldb.com/vuln/387175
- https://vuldb.com/vuln/387175/cti
- https://vuldb.com/cve/CVE-2026-19339
- https://vuldb.com/submit/865263
- https://github.com/aliyun/alibabacloud-dataworks-mcp-server/issues/27
- https://github.com/aliyun/alibabacloud-dataworks-mcp-server/
ADP enrichment
No English description supplied.
No references supplied.