Junglewise Threat Intelligence

CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

CVE-2016-3718 · Severity: critical · CVSS 5.5 · Exploited in the wild · Published 2021-11-03

Technologies: ImageMagick. Vendors: ImageMagick.

Executive brief

The HTTP and FTP coders in ImageMagick allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. This vulnerability is part of the 'ImageTragick' suite of vulnerabilities and can be used to bypass security controls or probe internal networks.

Affected products

  • ImageMagick ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1

Timeline

  • 2016-05-03: disclosed: Initial public disclosure of ImageTragick vulnerabilities.
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.

Related threats