What is GHSA-58g2-vgpg-335q?

GHSA-58g2-vgpg-335q is a security advisory published by GitHub Security Advisories with Medium severity. request-baskets vulnerable to Server-Side Request Forgery

Which CVE IDs does GHSA-58g2-vgpg-335q cover?

GHSA-58g2-vgpg-335q covers the following CVE IDs: CVE-2023-27163. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-58g2-vgpg-335q?

GHSA-58g2-vgpg-335q has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-58g2-vgpg-335q?

GHSA-58g2-vgpg-335q affects 1 product, including: go/github.com/darklynx/request-baskets:\u003c= 1.2.1.

GHSA-58g2-vgpg-335qMediumCVSS 6.5

request-baskets vulnerable to Server-Side Request Forgery

Vendor

GitHub Security Advisories

Published

March 31, 2023

Last Modified

August 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-27163 →

📋 Description

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

🎯 Affected products1

go/github.com/darklynx/request-baskets:<= 1.2.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2023-27163
https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3
https://github.com/darklynx/request-baskets
https://notes.sjtu.edu.cn/s/MUUhEymt7
http://request-baskets.com
http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html
http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html
https://github.com/advisories/GHSA-58g2-vgpg-335q