Server Side Request Forgery in svgSalamander · CVE-2017-5617 · GitHub Advisory Database · GitHub

Server Side Request Forgery in svgSalamander

High severity GitHub Reviewed Published Oct 19, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

com.kitfox.svg:svg-salamander (Maven)

Affected versions

< 1.1.2

Patched versions

1.1.2

Description

The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.

References

Published to the GitHub Advisory Database Oct 19, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023

Severity

High

7.4

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N