This vulnerability in QingdaoU OnlineJudge (up to version 1.6.1) allows remote attackers to perform server-side request forgery via manipulation of the service_url function in the judge_server_heartbeat endpoint. SSRF vulnerabilities enable attackers to induce the server to make unintended requests, potentially accessing internal resources or services. The vendor has not provided any response or patch, and no remediation level is documented. The CVSS 4.0 score of 5.3 reflects a medium impact with network attack vector, low complexity, no privileges required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the server send crafted requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. However, the CVSS score and vector indicate limited impact on confidentiality, integrity, and availability. There are no known exploits in the wild, and no vendor response or patch is available at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official QingdaoU channels for updates. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected service to trusted destinations only, if feasible.