CVE-2021-31216

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-312179.1In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.CVE-2021-31229.8CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document CVE-2021-312205.2SES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies.CVE-2021-312215.7SES Evolution before 2.1.0 allows deleting some parts of a security policy by leveraging access to a computer having the administration cons CVE-2021-312225.7SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration cons CVE-2021-312235.7SES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration conso CVE-2021-312243.5SES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security CVE-2021-312257.3SES Evolution before 2.1.0 allows deleting some resources not currently in use by any security policy by leveraging access to a computer hav CVE-2021-312269.8An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST requ CVE-2021-312277.5An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST requ CVE-2021-312287.5An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in ord CVE-2021-312296.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing cra