CVE-2024-22873 is a Server-Side Request Forgery (SSRF) vulnerability affecting Tencent Blueking CMDB versions 3.2.x up to but not including 3.10. The issue exists in the event subscription function (/service/subscription.go), where crafted POST requests can cause the server to make unauthorized internal requests. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this SSRF vulnerability could allow an attacker to access internal network resources that are not otherwise reachable externally, potentially leading to unauthorized data disclosure and modification. The confidentiality and integrity of internal systems may be compromised. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the event subscription function and monitor for suspicious POST requests targeting this endpoint. Avoid exposing the vulnerable service to untrusted networks where possible.