CVE-2024-41668

HIGH EPSS 43.4%
Published Jul 23, 20241y ago · Modified Jun 17, 20262w ago
8.3 CVSS 3.1
High
Find Similar
Published Jul 23, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery (SSRF) attack. Logged in users could do the same on private instances. A fix has been released in version 6.0.12. As a workaround, one might be able to disable `/proxy` endpoint entirely via, for example, nginx.

CVSS Details

Base Score
8.3
Exploitability
3.9
Impact
3.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
43.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 5

  • github.com https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5
  • github.com https://github.com/cBioPortal/cbioportal/pull/10884
  • github.com https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12
  • github.com https://github.com/cBioPortal/cbioportal/security/advisories/GHSA-9h44-r3c3-q7rm
  • wizlynxgroup.com https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-004

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.