Description (CNA)
A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| QingdaoU / OnlineJudge | affected 1.6.0; affected 1.6.1 |
CWE
CWE-918
References
- https://vuldb.com/vuln/355291
- https://vuldb.com/vuln/355291/cti
- https://vuldb.com/submit/782203
- https://github.com/AnalogyC0de/public_exp/issues/27
ADP enrichment
No English description supplied.
No references supplied.