ThingsBoard IoT Platform version 4.2.0 contains a Server-Side Request Forgery (SSRF) vulnerability. SSRF vulnerabilities occur when an attacker can manipulate server-side requests to access or interact with internal or external resources that the server can reach. This vulnerability could allow attackers to make unauthorized requests from the server, potentially exposing internal services or sensitive information. No details on affected subcomponents or exploitation methods are provided. No patch or vendor advisory information is available to confirm remediation status.

The SSRF vulnerability could enable attackers to make unauthorized requests from the ThingsBoard server to internal or external systems. This may lead to information disclosure or interaction with internal services that are otherwise inaccessible. However, no known exploits have been reported, and the exact impact depends on the server environment and configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting outbound requests from the ThingsBoard server and monitoring for unusual request patterns if feasible. Avoid exposing the vulnerable version in untrusted environments.