Netlify
Monthly
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.