CVE-2023-46725
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-46725 is a serious vulnerability affecting FoodCoopShop, an open-source software used by food coops and local shops. Versions 3.2.0 to 3.6.0 are at risk, as they contain a server-side request forgery (SSRF) issue. In the Network module, a manufacturer account can manipulate the `/api/updateProducts.json` endpoint, prompting the server to send a request to an attacker-specified host, effectively turning the server into a proxy to the internal network. Additionally, there exists a time of check to time of use (TOCTTOU) issue related to inadequate image validation checks, resulting in a full SSRF. The vulnerability is fixed in version 3.6.1.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Food Coop Shop
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions