What is GHSA-hc94-9v26-gxwv?

GHSA-hc94-9v26-gxwv is a security advisory published by GitHub Security Advisories with Critical severity. Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

Which CVE IDs does GHSA-hc94-9v26-gxwv cover?

GHSA-hc94-9v26-gxwv covers the following CVE IDs: CVE-2022-36663. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hc94-9v26-gxwv?

GHSA-hc94-9v26-gxwv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-hc94-9v26-gxwv?

GHSA-hc94-9v26-gxwv affects 1 product, including: maven/org.gluu:oxauth-common:\u003c 4.4.1.

GHSA-hc94-9v26-gxwvCriticalCVSS 9.8

Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

Vendor

GitHub Security Advisories

Published

September 7, 2022

Last Modified

April 6, 2023

🔗 CVE IDs covered (1)

CVE-2022-36663 →

📋 Description

Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.

🎯 Affected products1

maven/org.gluu:oxauth-common:< 4.4.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-36663
https://github.com/GluuFederation/oxAuth/releases/tag/4.4.1
https://gluu.org/gluu-4-4-1/
https://github.com/GluuFederation/oxAuth/commit/58c4ac9bbf2addf4b419bf155de99db57a202f5c
https://github.com/advisories/GHSA-hc94-9v26-gxwv