Attu
Monthly
Unauthenticated HTTP proxying in Zilliz Attu before 3.0.0 lets remote attackers abuse the Playground feature as an open proxy or server-side request forgery (SSRF) pivot, forwarding arbitrary HTTP and HTTPS requests to URLs on the public internet with no credentials required. The flaw is CWE-306 (missing authentication for a critical function) and is rated CVSS 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), meaning the attacker needs no authentication and no user interaction, and the main constraint is network reachability of the Attu management interface. Impact is bounded to proxied outbound requests rather than code execution or disclosure of Attu data, and there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
Server-side request forgery (SSRF) in Zilliz Attu before 3.0.0 allows remote attackers to proxy requests to private IP addresses via the Playground feature. This is a moderate-severity, not high-priority, issue: exploitation requires network access to an Attu instance's Playground feature, which proxies user-supplied requests without validating the destination; the CVSS vector indicates unauthenticated access (PR:N) with no user interaction, but real-world authentication enforcement is not confirmed. No public exploit identified at time of analysis.
Unauthenticated HTTP proxying in Zilliz Attu before 3.0.0 lets remote attackers abuse the Playground feature as an open proxy or server-side request forgery (SSRF) pivot, forwarding arbitrary HTTP and HTTPS requests to URLs on the public internet with no credentials required. The flaw is CWE-306 (missing authentication for a critical function) and is rated CVSS 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), meaning the attacker needs no authentication and no user interaction, and the main constraint is network reachability of the Attu management interface. Impact is bounded to proxied outbound requests rather than code execution or disclosure of Attu data, and there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
Server-side request forgery (SSRF) in Zilliz Attu before 3.0.0 allows remote attackers to proxy requests to private IP addresses via the Playground feature. This is a moderate-severity, not high-priority, issue: exploitation requires network access to an Attu instance's Playground feature, which proxies user-supplied requests without validating the destination; the CVSS vector indicates unauthenticated access (PR:N) with no user interaction, but real-world authentication enforcement is not confirmed. No public exploit identified at time of analysis.