CVE-2026-62282

6.5 Moyenne

Publiée le 18/09/2026 à 16:17 · Modifiée le 23/09/2026 à 19:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.

Traduire en français

Produits concernés

opencve

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0
https://github.com/opencve/opencve/issues/743
https://github.com/opencve/opencve/pull/747
https://github.com/opencve/opencve/releases/tag/v3.0.0
https://github.com/opencve/opencve/security/advisories/GHSA-ch3g-4xvr-674q
https://github.com/opencve/opencve/issues/743

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories