This vulnerability, identified as CWE-918, exists in JetBooking (a product by Crocoblock. Jetimpex Inc.) in versions up to and including 4.1.2. It allows an attacker with low privileges and no user interaction to perform Server-Side Request Forgery (SSRF), where the server can be tricked into making unauthorized requests. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts limited confidentiality and integrity but no availability impact. No official fix or patch has been published yet, and no known exploits are reported in the wild.

Exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary requests, potentially exposing internal resources or sensitive information. The impact is limited to partial loss of confidentiality and integrity, with no direct availability impact. Because the attack requires low privileges and no user interaction, it could be leveraged in certain scenarios to gather information or manipulate server-side operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected JetBooking versions and monitor for unusual server request activity. Avoid exposing the vulnerable functionality to untrusted users. Follow vendor communications for updates on patches or official mitigations.