Bug 2567550 (CVE-2026-115740)
| Summary: | CVE-2026-115740 DLP: DLP: Information disclosure via server-side request forgery | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in DLP. The application fails to validate file paths supplied to the evidence file endpoint, resulting in a Server-Side Request Forgery (SSRF) vulnerability. An authenticated remote attacker can submit an arbitrary Universal Naming Convention (UNC) network path, forcing the server to initiate Server Message Block (SMB) authentication to an external system. This flaw can lead to information disclosure by allowing the attacker to capture sensitive network authentication credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-05 22:06:48 UTC
|