This vulnerability exists in the aem-mcp-server project by indrasishbanerjee, specifically in the getAssetMetadata function of the src/mcp-server.ts file. By manipulating the assetPath argument, an attacker can perform server-side request forgery (SSRF), potentially causing the server to make unintended HTTP requests. The vulnerability is remotely exploitable and has been publicly disclosed. The project does not use versioning, making it difficult to identify affected or unaffected releases. The vendor has not yet provided a response or fix for this issue.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. The CVSS score of 5.3 indicates a medium impact level. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the project. Until a fix is provided, consider restricting network access from the affected server to sensitive internal resources as a temporary mitigation.