« Volver al listado

CVE-2024-0403

Estado: ModificadaMedia (6.5)—

Recipes version 1.5.10 allows arbitrary HTTP requests to be made

through the server. This is possible because the application is

vulnerable to SSRF.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tandoor — Recipes

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-0403",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-0403",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-05T19:20:20.872356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "help@fluidattacks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "help@fluidattacks.com",
      "affectedData": [
        {
          "vendor": "Recipes",
          "product": "Recipes",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.10"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:tandoorrecipes:recipes:1.5.10:*:*:*:*:*:*:*"
          ],
          "vendor": "tandoorrecipes",
          "product": "recipes",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.10"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-01T00:15:51.850",
  "references": [
    {
      "url": "https://fluidattacks.com/advisories/harris/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "help@fluidattacks.com"
    },
    {
      "url": "https://github.com/TandoorRecipes/recipes/",
      "tags": [
        "Product"
      ],
      "source": "help@fluidattacks.com"
    },
    {
      "url": "https://fluidattacks.com/advisories/harris/",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/TandoorRecipes/recipes/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "help@fluidattacks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Recipes version 1.5.10 allows arbitrary HTTP requests to be made\n\nthrough the server. This is possible because the application is\n\nvulnerable to SSRF."
    },
    {
      "lang": "es",
      "value": "La versión 1.5.10 de Recipes permite realizar solicitudes HTTP arbitrarias a través del servidor. Esto es posible porque la aplicación es vulnerable a SSRF."
    }
  ],
  "lastModified": "2026-06-17T06:53:25.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tandoor:recipes:1.5.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA984388-A8D2-4B58-A3CE-1D59F664A7A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "help@fluidattacks.com"
}