CVE-2021-33213

EUVD-2021-19925
An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Affected Products (NVD)
VendorProductVersion
element-ithttp_commander
5.3.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-027.txt
https://www.syss.de/pentest-blog/
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-027.txt
https://www.syss.de/pentest-blog/