Overview
- Description
- The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.5
- Impact score
- 3.6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 4.3
- Impact score
- 2.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:P/A:N
Known exploits
Data from CISA
- Vulnerability name
- ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
- Exploit added on
- Nov 3, 2021
- Exploit action due
- May 3, 2022
- Required action
- Apply updates per vendor instructions.
Weaknesses
- nvd@nist.gov
- CWE-918
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "967EC28A-607F-48F4-AD64-5E3041C768F0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE1D81A1-CD24-4B17-8AFD-DC95E90AD7D0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "807C024A-F8E8-4B48-A349-4C68CD252CA1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F96E3779-F56A-45FF-BB3D-4980527D721E"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CF73560-2F5B-4723-A8A1-9AADBB3ADA00"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BF3C7A5-9117-42C7-BEA1-4AA378A582EF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83737173-E12E-4641-BC49-0BD84A6B29D0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C84EAAE7-0249-4EA1-B8D3-E039B03ACDC3"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2148300C-ECBD-4ED5-A164-79629859DD43"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "837F0D24-99B3-4093-A45A-53ADB0367FCF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "357FDE3E-2248-4BCD-B726-97C4D92FDCB7"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E420B889-BB89-4B64-B0E0-7E9B8545B959"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B908AEF5-67CE-42D4-961D-C0E7ADB78ADD"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F8EB695-5EA3-46D2-941E-D7F01AB99A48"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E1DB003-76B8-4D7B-A6ED-5064C3AE1C11"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFC68D88-3CD3-4A3D-A01B-E9DBACD9B9CB"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D8D654F-2442-4EA0-AF89-6AC2CD214772"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BCF87FD-9358-42A5-9917-25DF0180A5A6"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9835090F-120A-4A53-B4A8-375DD6999167"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E5B5F9E-D749-45E5-8538-7CED9620C00C"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "188019BF-3700-4B3F-BFA5-553B2B545B7F"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B8B2E32-B838-4E51-BAA2-764089D2A684"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4319B943-7B19-468D-A160-5895F7F997A3"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39C1ABF5-4070-4AA7-BAB8-4F63E1BD91FF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8036E2AE-4E44-4FA5-AFFB-A3724BFDD654"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A584AAA-A14F-4C64-8FED-675DC36F69A3"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D373A806-8A25-4BD4-8511-879D8755C326"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFE6C909-798B-4B7A-9BD4-6741933DBC1F"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9A24D0C-604D-4421-AFA6-5D541DA2E94D"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A2E3637-B6A6-4DA9-8B0A-E91F22130A45"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F81F859C-DA89-4D1E-91D3-A000AD646203"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "418488A5-2912-406C-9337-B8E85D0C2B57"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2FAC325-6EEB-466D-9EBA-8ED4DBC9CFBF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C84489B-B08C-4854-8A12-D01B6E45CF79"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39A901D6-0874-46A4-92A8-5F72C7A89E85"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C8D871B-AEA1-4407-AEE3-47EC782250FF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98381E61-F082-4302-B51F-5648884F998B"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D99A687E-EAE6-417E-A88E-D0082BC194CD"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7431ABC1-9252-419E-8CC1-311B41360078"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AE981D4-0CA1-46FA-8E91-E1A4D5B31383"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F732C7C9-A9CC-4DEF-A8BE-D0F18C944C78"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE561C57-71DE-434A-85BC-1FAAFDCC7058"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6755B6AD-0422-467B-8115-34A60B1D1A40"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24C0F4E1-C52C-41E0-9F14-F83ADD5CC7ED"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17F256A9-D3B9-4C72-B013-4EFD878BFEA8"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87477201-64C5-490B-AAE1-23D26F774989",
"versionEndExcluding": "6.9.3-10"
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B7CCC6B-C66E-48E2-BA1E-CBF6421B4FEB"
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "693C9F8F-A8C1-4D06-8F31-E085E16E701C"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E88A537F-F4D0-46B9-9E37-965233C2A355"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7B037A8-72A6-4DFF-94B2-D688A5F6F876"
},
{
"criteria": "cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44B8FEDF-6CB0-46E9-9AD7-4445B001C158"
},
{
"criteria": "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "964B57CD-CB8A-4520-B358-1C93EC5EF2DC"
},
{
"criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5900A25-FDD7-4900-BF7C-F3ECCB714D2B"
},
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58D3B6FD-B474-4B09-B644-A8634A629280"
},
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F892F1B0-514C-42F7-90AE-12ACDFDC1033"
},
{
"criteria": "cpe:2.3:a:suse:manager:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD4EEF7C-CC33-4494-8531-7C0CC28A8823"
},
{
"criteria": "cpe:2.3:a:suse:manager_proxy:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CBED083-B935-4C47-BBDA-F39D8EA277ED"
},
{
"criteria": "cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD6136E8-74DE-48AF-A8AB-B0E93D34870C"
},
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2DF4815-B8CB-4AD3-B91D-2E09A8E318E9"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A0BA503-3F96-48DA-AF47-FBA37A9D0C48"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB6476C7-03F2-4939-AB85-69AA524516D9"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B12243B2-D726-404C-ABFF-F1AB51BA1783"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55C5561F-BE86-4EEA-99D4-8697F8BD9DFE"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15FC9014-BD85-4382-9D04-C0703E901D7A"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2076747F-A98E-4DD9-9B52-BF1732BCAD3D"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D41A798E-0D69-43C7-9A63-1E5921138EAC"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1831D45A-EE6E-4220-8F8C-248B69520948"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A633996-2FD7-467C-BAA6-529E16BD06D1"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "028ABA8F-4E7B-4CD0-B6FC-3A0941E254BA"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED540469-C4DD-485D-9B89-6877B2A74217"
}
],
"operator": "OR"
}
]
}
]