Threats tagged 'ghsa-f37m-qrrx-ww7w'

Kortix Suna versions from 0.10.7 up to but not including 0.13.52 contain a server-side request forgery (SSRF) vulnerability. This flaw allows project managers with write permissions on project connectors to bypass IP address restrictions by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. Exploiting this, attackers can set connector URLs to access internal services and cloud metadata endpoints, potentially reading sensitive responses. The vulnerability has a low CVSS 4.0 score of 2.3, indicating limited impact and exploitability.