CVE-2022-23071CWE-918

CVE-2022-23071: vulnerability in recipes

Recipes - SSRF on Import

Published · Updated

Follow this CVE+ Monitor recipes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.0%
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.
Affected products
recipes · recipes
Related CVEs — recipes

In the same product, most dangerous first.

CVE-2022-23074—Recipes - Stored XSS in Name ParameterEPSS 0.9%CVE-2022-23073—Recipes - Stored XSS in ClipboardEPSS 0.9%CVE-2022-23072—Recipes - Stored XSS in Add to CartEPSS 0.9%