CVE-2021-47703
Last modified
CVE-2021-47703 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through the affected application, allowing hijacking of current sessions. Attackers can specify an external domain in the 'ip' parameter to force the application to make an HTTP request to an arbitrary destination host.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through the affected application, allowing hijacking of current sessions. Attackers can specify an external domain in the 'ip' parameter to force the application to make an HTTP request to an arbitrary destination host.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openbmcs | Openbmcs | 2.4 |
References
- https://www.exploit-db.com/exploits/50670Exploit, Third Party Advisory, VDB Entry
- https://www.openbmcs.comProduct
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5694.phpExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-47703?
How severe is CVE-2021-47703?
How do I fix CVE-2021-47703?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-47697Nagios XI versions prior to 5.8.0 are vulnerable to cross-si…5.4
- CVE-2021-47698Nagios XI versions prior to 5.8.7 using embedded Nagios Core…5.4
- CVE-2021-47699Nagios XI versions prior to 5.8.7 are vulnerable to cross-si…5.4
- CVE-2021-47700Nagios XI versions prior to 5.8.7 used a temporary directory…7.8
- CVE-2021-47701OpenBMCS 2.4 allows an attacker to escalate privileges from …8.8
- CVE-2021-47702OpenBMCS 2.4 contains a CSRF vulnerability that allows attac…4.3
- CVE-2021-47704OpenBMCS 2.4 contains an SQL injection vulnerability that al…6.5
- CVE-2021-47705COMMAX UMS Client ActiveX Control 1.7.0.2 contains a heap-ba…8.7
- CVE-2021-47706COMMAX Biometric Access Control System 1.0.0 contains an aut…8.7
- CVE-2021-47707COMMAX CVD-Axx DVR 5.1.4 contains weak default administrativ…9.3
- CVE-2021-47708COMMAX Smart Home System CDP-1020n contains an SQL injection…9.3
- CVE-2021-47709COMMAX Smart Home System allows an unauthenticated attacker …8.7
Are you affected by CVE-2021-47703?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST