Critical severity · published Jun 13, 2022
CVE-2021-40604
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via…
9.1
CVSS
1.2%
EPSS
No
On KEV
Description
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Ips Community Suite · Invisioncommunity
before 4.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40604
Release Notes
https://invisioncommunity.com/release-notes/462-r99/
More from Ips Community Suite
8.8
CVE-2021-32924
Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method…
8.8
CVE-2021-3025
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in…
6.1
CVE-2021-3026
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment