Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
renovate
Vendor
renovatebot
Product
renovate
Platforms
Unknown
Default status
unaffected
renovate · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
44.79.0
Unavailable
None listed
renovate-ce
Vendor
mend
Product
renovate-ce
Platforms
Unknown
Default status
unaffected
renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.6.0
Unavailable
None listed
renovate-ee-server
Vendor
mend
Product
renovate-ee-server
Platforms
Unknown
Default status
unaffected
renovate-ee-server · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.6.0
Unavailable
None listed
renovate-ee-worker
Vendor
mend
Product
renovate-ee-worker
Platforms
Unknown
Default status
unaffected
renovate-ee-worker · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.6.0
Unavailable
None listed
mend-renovate-ce helm chart
Vendor
mend
Product
mend-renovate-ce helm chart
Platforms
Unknown
Default status
unaffected
mend-renovate-ce helm chart · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.6.0
Unavailable
None listed
mend-renovate-enterprise-edition helm chart
Vendor
mend
Product
mend-renovate-enterprise-edition helm chart
Platforms
Unknown
Default status
unaffected
mend-renovate-enterprise-edition helm chart · Scoped product and version facts