Mosparo
Monthly
Stored SSRF in mosparo's automatic rule package source URL feature allows a project editor to plant an attacker-controlled URL that the mosparo server subsequently fetches without restricting private or loopback destinations. Any authenticated project member with the editor role can exploit this to probe internal HTTP services behind the mosparo host, effectively turning the application into a network reconnaissance oracle. A publicly available proof-of-concept exists per SSVC data; however, the vulnerability is not listed in CISA KEV and carries a very low EPSS of 0.03%, suggesting no observed widespread exploitation at time of analysis.
Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored SSRF in mosparo's automatic rule package source URL feature allows a project editor to plant an attacker-controlled URL that the mosparo server subsequently fetches without restricting private or loopback destinations. Any authenticated project member with the editor role can exploit this to probe internal HTTP services behind the mosparo host, effectively turning the application into a network reconnaissance oracle. A publicly available proof-of-concept exists per SSVC data; however, the vulnerability is not listed in CISA KEV and carries a very low EPSS of 0.03%, suggesting no observed widespread exploitation at time of analysis.
Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.