An SSRF vulnerability was found in an API from Ctrip Apollo up to and including 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
ctrip apollo |