Server-Side Request Forgery Vulnerability in Appwrite by Null
CVE-2024-1063

5.3MEDIUM

Key Information:

Vendor

Appwrite

Status
Appwrite
Vendor
CVE Published:
30 January 2024

What is CVE-2024-1063?

A vulnerability affecting Appwrite versions up to v1.4.13 allows for a Server-Side Request Forgery (SSRF) exploitation through the '/v1/avatars/favicon' endpoint. The flaw arises from an incomplete fix implemented in a previous vulnerability (CVE-2023-27159), which can potentially allow attackers to interact with internal services or systems that are not intended to be accessed externally. Protecting against this vulnerability is crucial to safeguarding application integrity and user data.

Affected Version(s)

Appwrite 0 <= 1.4.13

References

https://www.tenable.com/security/research/tra-2024-03

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.