CVE-2021-40604
Critical
Description
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
SeverityCritical
CVSS9.1
Exploit probability—
ProductInvisioncommunity Ips Community Suite
PublishedJun 13, 2022
First seenJun 13, 2022
How to fix
Update
- invisioncommunity ips_community_suite4.6.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| invisioncommunity ips_community_suite | v < 4.6.2 | 4.6.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.