DigDash fixes three vulnerabilities including a SSRF flaw

guest · Jun 18, 2020

DigDash fixes SSRF flaw
June 17, 2020 (Updated June 18, 2020)
https://portswigger.net/daily-swig/digdash-fixes-ssrf-flaw

UPDATED Security testing firm Bishop Fox has found three vulnerabilities in business intelligence software DigDash Enterprise, including a server-side request forgery (SSRF) flaw.

The flaws appear in versions 2018R1, 2019R1, 2019R2 and 2020R1 of DigDash Enterprise, a dashboard-based data visualization application that helps enterprises to create interactive data applications.
The SSRF vulnerability, rated high risk, allowed the disclosure of a service password that could enable an attacker to access user credentials stored in the platform's authentication service.

“This authentication service contains information about all users,” Florian Nivette, a managing security associate at Bishop Fox, told The Daily Swig.
“The server-side request forgery is a pre-authentication attack located on the login page - accessible without an account,” he said in an advisory on the Bishop Fox website.
Click to expand...

Finally, DigDash also had a cross-site scripting (XSS) vulnerability, rated as only low risk. This allowed the execution of a JavaScript payload using malicious links sent to a DigDash user, and could be exploited, without authentication, to target administrators and steal their sessions.
Click to expand...

Log in or Sign up

DigDash fixes three vulnerabilities including a SSRF flaw

guest Guest

Log in or Sign up

DigDash fixes three vulnerabilities including a SSRF flaw

guest Guest

Useful Searches