Skipper
CVE-2022-38580
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
AnalysisAI
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.
Technical ContextAI
This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Affected products include: Zalando Skipper.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary
Skipper versions before 0.23.0 allow authenticated users with Ingress resource creation privileges to execute arbitrary
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. Rated high severity (CVS
Skipper versions up to 0.24.0 contains a vulnerability that allows attackers to list targets of an ExternalName and allo
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today