SSRF Vulnerability in Apache Olingo Affects Data Security

CVE-2020-1925

Summary

Apache Olingo versions ranging from 4.0.0 to 4.7.0 are susceptible to a server-side request forgery (SSRF) vulnerability through the AsyncRequestWrapperImpl class. This class reads a URL from the Location header and can initiate GET or DELETE requests, potentially allowing malicious servers to solicit requests from clients. If an attacker can lure a client into connecting to their compromised server, they may exploit this behavior to access internal resources that are not typically reachable by the attacker, thus compromising the integrity and confidentiality of sensitive data.

References