CVE-2023-39967 is a critical server-side request forgery (SSRF) vulnerability affecting WireMock Studio, a tool for mocking HTTP services. It allows an unauthenticated attacker to forward requests to arbitrary services reachable from the WireMock instance by manipulating configuration fields with specially crafted URLs. With a CVSS score of 10.0, this vulnerability has a network attack vector, low complexity, and can lead to complete compromise of confidentiality, integrity, and availability. The vendor has discontinued WireMock Studio and will not provide a fix, advising users to seek alternatives. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.32.0-17CPE matchmatch criteria | cpe:2.3:a:wiremock:studio:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.