This vulnerability exists in crmeb_java 1.4 within the RestTemplate.getForEntity method of the crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java file. The manipulation of the URL parameter leads to server-side request forgery, enabling an attacker to cause the server to send crafted requests to arbitrary destinations. The vulnerability is remotely exploitable without authentication. Although the issue was disclosed early to the project maintainers, no official remediation or patch has been released as of the publication date.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform unauthorized requests to internal or external systems. This can lead to information disclosure, interaction with internal services, or other indirect impacts depending on the server's network environment. The CVSS score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests and validate or sanitize URL inputs where possible.