← Back to CVEs

CVE-2023-7078

HIGH

7.5

Description

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack VectorADJACENT_NETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published12/29/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

cloudflare:miniflare

Weaknesses (CWE)

CWE-918CWE-918

References

https://github.com/cloudflare/workers-sdk/pull/4532(cna@cloudflare.com)

https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7(cna@cloudflare.com)

https://github.com/cloudflare/workers-sdk/pull/4532(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.