CVE-2018-10220

HIGH

Glastopf 3.1.3-dev - Server-Side Request Forgery via abc.php a Parameter

Title source: llm
STIX 2.1

Description

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/mushorg/glastopf/issues/286

Scores

CVSS v3 8.8
EPSS 0.0169
EPSS Percentile 74.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (1)
mushmush/glastopf 3.1.3 dev
Published Apr 19, 2018
Tracked Since Feb 18, 2026