This vulnerability involves an SSRF flaw in the TunnelServlet component of agorum core open versions 11.9.2 and 11.10.1. An attacker can exploit this by crafting requests that force the server to connect to arbitrary internal or external resources, potentially exposing sensitive information. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and partial confidentiality and integrity impact. There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation can lead to unauthorized server-initiated connections to internal or external systems, which may result in sensitive data exposure. The confidentiality and integrity of data can be partially compromised. There is no direct impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable component and monitoring for unusual request patterns targeting the TunnelServlet. Avoid exposing this component to untrusted networks if possible.