DataLinkDC Dinky proxy endpoint allows server-side request forgery
A data job tool could let attackers peek at internal information.
Summary
A remote attacker can make the flink_web proxy endpoint in Dinky up to 1.2.5 send requests on the server's behalf. A public exploit exists, so the flaw may be used.
What to do
No fixed version is named. Check that the Dinky you run is newer than 1.2.5, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
Times
First published
First seen