CVE-2020-35205 - Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file

Back Back to CVE browser

CRITICAL

Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file

Published Jan 11, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 1.93%

Description

Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22892
Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22892		Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications		x_refsource_MISCExploitThird Party Advisory