CVE-2021-22255

SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
GitLabCNA
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
baserowbaserow
0.6.0 ≤
𝑥
< 1.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://baserow.io/blog/march-2021-release-of-baserow
https://gitlab.com/bramw/baserow/-/issues/370
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json
https://baserow.io/blog/march-2021-release-of-baserow
https://gitlab.com/bramw/baserow/-/issues/370
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22255.json