CVE-2018-10220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mushorg/glastopf/issues/286Exploit, Issue Tracking, Third Party Advisory
https://github.com/mushorg/glastopf/issues/286Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Apr 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-102215.4An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tag[ta CVE-2018-102228.8An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&d CVE-2018-102236.8An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.htm CVE-2018-102246.8An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html.CVE-2018-102259.8thinkphp 3.1.3 has SQL Injection via the index.php s parameter.CVE-2018-102275.4MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.CVE-2018-102286.1Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to in CVE-2018-102294.8A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript CVE-2018-10237.5A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corr CVE-2018-102306.1Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.CVE-2018-102316.1Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject CVE-2018-102326.5Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to