CVE-2019-10686: Server-Side Request Forgery (SSRF)

April 1, 2019 (updated April 4, 2019)

An SSRF vulnerability was found in an API from Ctrip Apollo. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

References

nvd.nist.gov/vuln/detail/CVE-2019-10686

Detect and mitigate CVE-2019-10686 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →