Vendors / appwrite Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now appwrite records in CISA KEV No appwrite vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 72
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.36419 · Published 2023-03-31 · No fix listed CWE-918
Priority HIGH 72
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00793 · Published 2024-02-22 · Fixed in 0.12.2 CWE-22
Priority MEDIUM 46
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02117 · Published 2022-02-16 · Fixed in 0.3.12, 0.12.2 +1 CWE-1321
Priority LOW 39
Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00445 · Published 2024-01-30 · No fix listed CWE-918
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00847 · Published 2022-09-09 · Fixed in 1.0.0-RC1 CWE-79
Open these records in search → All records by CVSS severity
1 4 3 0 0
THREATIST.IORead the docs