CVE-2019-8982

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.

Score

CVSS 3.0 9.6 Critical

Status

Modified - cve@mitre.org

Published

2019-02-21

Last modified

2024-09-16

Weaknesses

CWE-918

Affected products

• Wavemarker Studio (Wavemaker)

References

• https://www.exploit-db.com/exploits/45158