title: Cellopoint CelloOS - Server-Side Request Forgery (SSRF)
description: Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
product: CelloOS
vendor: Cellopoint
versions:
lessThanOrEqual: v4.1.10 Build 20190922, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Update to v4.1.12 Build 20200701 or higher.