Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2018-15657: SureMDM can be tricked to contact internal servers
CVE-2018-15657 · published 7 years ago
Summary
The SureMDM management system lets an attacker supply a web address that the server will fetch. This can be used to reach internal network services that are not normally exposed, potentially revealing private data or enabling further attacks. Update SureMDM to the latest version or apply the vendor’s patch to stop the unsafe URL handling.
What to do
- Update 42gears suremdm to version 2018-11-27 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| 42gears | suremdm |
< 2018-11-27 cpe:2.3:a:42gears:suremdm:*:*:*:*:*:*:*:* |
Original advisory text
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
References
- https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-fou... Exploit Third Party Advisory
- https://www.exploit-db.com/exploits/46305/ Exploit Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Feb 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-15657 · NVD
Track software like this
Free during beta