Threats tagged 'ghsa-8xfr-4vj4-6h48'

ArcReel versions 0.32.0, 0.33.0, and 0.34.0 contain a server-side request forgery (SSRF) vulnerability in the Provider Test-Connection Endpoint (/api/v1/providers/{id}/test). This vulnerability allows remote attackers to induce the server to make unintended requests. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently provided.