Vulnerabilities

TI-2017-04064 CVE-2017-6201 · GHSA-r7qf-prj4-7jhp

A Server Side Request Forgery vulnerability exists in the install app process in…

LOW 39

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203.

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.01854 Published 2018-02-06 No fix listed CWE-918

TI-2017-04063 CVE-2017-6200 · GHSA-hj86-pqmv-q7pr

LOW 33

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02311 Published 2018-02-06 No fix listed CWE-200

TI-2017-04062 CVE-2017-6199 · GHSA-hwf7-pj3r-v27q

MEDIUM 47

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02977 Published 2018-02-06 No fix listed CWE-287

TI-2017-04061 CVE-2017-6198 · GHSA-9jf5-h94c-4h3g

LOW 32

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0138 Published 2018-02-06 No fix listed CWE-400