CVE-2019-10686: Server-Side Request Forgery (SSRF)

April 18, 2019 (updated September 10, 2021)

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

References

github.com/advisories/GHSA-fvx3-g627-phm2
github.com/ctripcorp/apollo/issues/2103
nvd.nist.gov/vuln/detail/CVE-2019-10686

Detect and mitigate CVE-2019-10686 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →