CVE-2023-7078
Last modified
CVE-2023-7078 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers. . EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | Miniflare | >= 3.20230821.0, < 3.20231030.2 |
References
- https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7Patch, Third Party Advisory
- https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-7078?
How severe is CVE-2023-7078?
How do I fix CVE-2023-7078?
Are you affected by CVE-2023-7078?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST