CVE-2022-31196
High
Description
Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.
SeverityHigh
CVSS7.6
Exploit probability—
ProductDatabasir
PublishedSep 2, 2022
First seenSep 2, 2022
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- databasir databasir1.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| databasir databasir | v < 1.0.7 | 1.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.