| Vulnerability Name: | CCN-122297 | ||||||
| Published: | 2017-02-20 | ||||||
| Updated: | 2017-02-20 | ||||||
| Summary: | Java and Python are vulnerable to server-side request forgery, caused by an FTP protocol injection flaw in the built-in URL fetching library (urllib2 in Python 2 and urllib in Python 3) and Java's FTP URL handling code. By persuading a user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to read arbitrary files. An attacker could exploit this vulnerability to gain access to the system. | ||||||
| CVSS v3 Severity: | 6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) 6.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C)
| ||||||
| CVSS v2 Severity: | 6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: Blindspot Security Blog, Monday, February 20, 2017 Advisory: Java/Python FTP Injections Allow for Firewall Bypass Source: CCN Type: The Hacker News Web site Unpatched Python and Java Flaws Let Hackers Bypass Firewall Using FTP Injection Source: CCN Type: Oracle Web site Java Source: XF Type: UNKNOWN java-python-ssrf(122297) Source: CCN Type: Python Web site Welcome to Python.org | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||