CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.
Configurations

Configuration 1

cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*

Information

Published : 2021-09-07 07:15

Updated : 2021-09-14 04:20


NVD link : CVE-2021-39195

Mitre link : CVE-2021-39195

Products Affected
No products.
CWE
CWE-918

Server-Side Request Forgery (SSRF)