CVE-2024-1063: 
Homebrew Analyse et atténuation des vulnérabilités

Appwrite versions 1.4.13 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability via the '/v1/avatars/favicon' endpoint. This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2023-27159) (Tenable Advisory).

The vulnerability has been assigned CVE-2024-1063 and received a CVSS v3.1 base score of 7.5 (HIGH) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. However, Tenable assigned a lower CVSS score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) (NVD).

The SSRF vulnerability could allow an unauthenticated attacker to make server-side requests to internal or external systems through the affected endpoint, potentially leading to unauthorized access to sensitive information (Tenable Advisory).

The vulnerability is unauthenticated and requires low attack complexity to exploit. No user interaction is needed to carry out the attack (NVD).

Users are advised to upgrade to Appwrite version 1.5.0 or later to address this vulnerability (Tenable Advisory).