Threats tagged 'ghsa-fc85-mqvw-fgvh'

A server-side request forgery (SSRF) vulnerability exists in JeecgBoot up to version 3.9.1, specifically in the OpenApiController.add and OpenApiController.call functions of the OpenApiController.java component. This vulnerability allows remote attackers to manipulate the originUrl parameter, potentially causing the server to make unintended requests. The vulnerability has a CVSS score of 6.3 (medium severity). The vendor has confirmed the issue and plans to release a fix in an upcoming version. Public exploit code is available, but no active exploitation in the wild is currently known.