CVE-2018-9920 Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.
MediumCVSS 6.5
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| k2 smartforms | = 4.6.11 | No fix listed |
References
- 20180522 K2 smartforms runtime application - 4.6.11 SSRF mailing-list third-party-advisory vdb-entry