CVE-2023-32750

Summary

CVE-2023-32750 is a newly disclosed vulnerability in Pydio Cells, a file hosting and syncing solution. The issue allows for Server Side Request Forgery (SSRF), potentially enabling attackers to induce the backend server to send HTTP requests to specified malicious URLs. In longer running processes, Pydio Cells offers a "remote-download" job feature which can be exploited to cause the backend to fetch data from these malicious URLs and save the response as a file in a user-specified folder within the Pydio Cells environment. This vulnerability could lead to data leakage or unauthorized access to internal systems. Users of Pydio Cells versions up to 4.1.2 are encouraged to upgrade to a patched version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.