CVE-2023-32750 EXPLOIT
6.5
MEDIUM · CVSS 3.1 · EPSS 3.8% (pctl 90)
Patch early
A public exploit exists.
Description
Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The response file is then available in a user-specified folder in Pydio Cells.
Scoring
| CVSS | 6.5 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 3.85% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-918 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2023-06-08 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| pydio | cells |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Pydio Cells 4.1.2 - Server-Side Request Forgery | 2023-05-31 |
References
- https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
- https://www.redteam-pentesting.de/advisories/rt-sa-2023-005/
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
→ the Explorer · watch your stack · NVD