漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
Vulnerability Description
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
WireMock 代码问题漏洞
Vulnerability Description
WireMock是WireMock开源的一种流行的API模拟测试开源工具。 WireMock存在代码问题漏洞，该漏洞源于当WireMock Studio配置字段中使用某些请求URL时，该请求可能会转发到可从WireMock实例访问的任意服务。
CVSS Information
N/A
Vulnerability Type
N/A