CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.

• CWE-918

• http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.htmlThird Party Advisory
• https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.htmlThird Party Advisory
• https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/Release Notes, Vendor Advisory

Published

May 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7642D-Link routers with the mydlink feature have some web interf…7.5
• CVE-2019-7644Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected …
• CVE-2019-7646CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8…
• CVE-2019-7648controller/fetchpwd.php and controller/doAction.php in Hotel…
• CVE-2019-7649global.encryptPassword in bootstrap/global.js in CMSWing 1.3…
• CVE-2019-7651EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 al…
• CVE-2019-7653The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.…9.8
• CVE-2019-7654Wowza Streaming Engine 4.8.0 and earlier suffers from multip…6.5
• CVE-2019-7655Wowza Streaming Engine 4.8.0 and earlier from multiple authe…5.4
• CVE-2019-7656A privilege escalation vulnerability in Wowza Streaming Engi…7.8
• CVE-2019-7659Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers…
• CVE-2019-7660An issue was discovered in PHPMyWind 5.5. The username param…