This vulnerability in JeecgBoot (up to version 3.9.1) allows an attacker to perform server-side request forgery via the originUrl parameter in the OpenApiController's add and call functions. By manipulating this parameter, an attacker can cause the server to make unintended HTTP requests. The issue is confirmed by the vendor, who intends to provide a fix in an upcoming release. No patch is currently available, and exploitation requires no user interaction but does require some privileges (PR:L).

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary HTTP requests from the affected server, potentially accessing internal resources or services not directly exposed to the attacker. The CVSS score of 5.3 indicates a medium impact, reflecting limited privileges required and low complexity of attack. There are no known exploits in the wild at this time.

The vendor has confirmed the vulnerability and plans to release an official fix in a future version. Until the patch is available, users should consider upgrading to a later version once released. No official workaround or temporary fix is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.