CVE-2023-27159: 
PHP Analyse et atténuation des vulnérabilités

CVE-2023-27159 is a Server-Side Request Forgery (SSRF) vulnerability discovered in Appwrite versions up to v1.2.1. The vulnerability exists in the '/v1/avatars/favicon' component and allows attackers to access network resources and sensitive information through crafted GET requests (NVD, GitHub Advisory).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) with a CVSS v3.1 base score of 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability specifically affects the API endpoint '/v1/avatars/favicon' and can be exploited via the URL parameter without requiring authentication (NVD).

The vulnerability allows attackers to access internal network resources and sensitive information. It can lead to information disclosure and potential escalation of privileges. The high CVSS score reflects the significant potential impact on system confidentiality (GitHub Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. A proof of concept exists demonstrating exploitation via a crafted GET request to the '/v1/avatars/favicon' endpoint (GitHub Advisory).

Users should upgrade to a version newer than Appwrite v1.2.1 to address this vulnerability. The issue was later found to have an incomplete fix, leading to CVE-2024-1063, suggesting users should upgrade to version 1.5.0 or later for complete mitigation (Tenable Advisory).