The vulnerability in crmeb_java 1.4 arises from improper handling of the URL parameter in the RestTemplate.getForEntity method within the base64 Qrcode Endpoint. This flaw enables an attacker to perform server-side request forgery by controlling the URL argument, causing the server to send crafted requests to arbitrary destinations. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). The project has been informed but has not issued a patch or mitigation to date.

Successful exploitation of this SSRF vulnerability could allow an attacker to induce the vulnerable server to make unintended HTTP requests to internal or external systems. This may lead to information disclosure or interaction with internal services not otherwise accessible. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level controls to restrict outbound requests from the affected component or apply input validation to the URL parameter as a temporary mitigation until an official fix is available.