Description (CNA)
A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| automatisch / automatisch | affected 0 through 41f3c56 |
CWE
CWE-918
References
- https://github.com/automatisch/automatisch
- https://github.com/automatisch/automatisch/blob/main/packages/backend/src/apps/http-request/actions/custom-request/index.js
ADP enrichment
No English description supplied.
No references supplied.