CVE-2023-39854

EUVD-2023-43554
The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
atxucrypt
𝑥
≤ 3.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://wiki.notveg.ninja/blog/CVE-2023-39854/
https://wiki.notveg.ninja/blog/CVE-2023-39854/