This vulnerability (CWE-918) allows an authenticated administrator with the licensed gateway role enabled to supply a connector URL that the Kiteworks Core server retrieves without sufficient validation of the URL scheme or destination. This can lead to the server issuing requests to internal network services, potentially exposing internal resources. The issue affects Kiteworks Core versions from 0 up to but not including 9.5.1. Exploitation requires the gateway role to be active, limiting the attack surface. The CVSS 3.1 base score is 3.3, reflecting low impact with high attack complexity and required privileges.

The impact is limited to low confidentiality and integrity loss due to SSRF, with no availability impact. The attacker must be an authenticated administrator with the licensed gateway role enabled, which reduces the likelihood and scope of exploitation. There are no known exploits in the wild. The vulnerability could allow internal network requests that might reveal information or interact with internal services in unintended ways.

No explicit patch or remediation details are provided in the input data. Since the affected versions are prior to 9.5.1, upgrading to version 9.5.1 or later is implied to remediate the issue. Administrators should verify if their deployment uses the licensed gateway role and consider upgrading to a fixed version. Patch status is not yet confirmed explicitly; check the vendor advisory for current remediation guidance.