CVE-2017-5617 Server Side Request Forgery in svgSalamander
HighCVSS 7.4
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.kitfox.svg/svg-salamander(Maven) | < 1.1.2 | 1.1.2 |
| debian/svgsalamander(Debian:12) | < 1.1.1+dfsg-2 | 1.1.1+dfsg-2 |
| debian/svgsalamander(Debian:14) | < 1.1.1+dfsg-2 | 1.1.1+dfsg-2 |
| debian/svgsalamander(Debian:13) | < 1.1.1+dfsg-2 | 1.1.1+dfsg-2 |
| com.kitfox.svg/svg-salamander(Maven) | = 1.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| kitfox svg salamander | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- GLSA-202003-11 third-party-advisory vendor-advisory
- DSA-3781 third-party-advisory vendor-advisory
- [oss-security] 20170127 SSRF issue in the svgsalamander library mailing-list third-party-advisory
- [oss-security] 20170129 Re: SSRF issue in the svgsalamander library mailing-list third-party-advisory
- 95871 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-5617 vendor-advisory
- bugs.debian.org issue-tracking
- github.com product
- FEDORA-2019-735d3953e8 vendor-advisory
- FEDORA-2019-3cbce64a64 vendor-advisory