CVE-2021-39195 — Server-Side Request Forgery vulnerability in misskey
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachme…
Published: 2021-09-07 · CVSS: 7.7 · CVSS 3.1
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7