The vulnerability in givanz Vvveb affects the oEmbedProxy() handler in admin/controller/editor/editor.php, which accepts a user-controlled URL parameter passed to getUrl(). The validateUrl() function only checks the hostname string but does not validate the resolved IP addresses, allowing an attacker with authenticated editor-level access to invoke the endpoint with hostnames resolving to private, loopback, link-local, or reserved IP addresses. This causes the server to issue HTTP or HTTPS requests to internal services and return the response body, potentially exposing sensitive internal data such as cloud instance metadata and credentials. The endpoint is accessible via a GET request without CSRF protection. The issue is resolved in version 1.0.8.5.

An attacker with authenticated editor permissions can exploit this SSRF vulnerability to make the server perform HTTP(S) requests to internal or otherwise restricted network addresses. This can lead to disclosure of internal service responses and sensitive cloud instance metadata, including credentials. Storefront users and anonymous visitors cannot exploit this vulnerability. The vulnerability has a high severity score of 8.4 (CVSS 4.0) due to its potential to expose sensitive internal information.

Upgrade to givanz Vvveb version 1.0.8.5 or later, where this SSRF vulnerability is fixed. Until the upgrade, restrict editor-level access to trusted users only. Note that the vulnerable endpoint uses GET requests without CSRF tokens, so additional access controls or request validation may be necessary as a temporary mitigation.