Threats tagged 'ghsa-gq4w-px3f-vc47'

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor affecting versions up to 3.32.4, 3.33.0, 3.34.0-rc3, and 4.0.0-alpha.1. The flaw is in the WorkflowSystemTask.start function within the PlannerContextFetchTask.java file. This vulnerability allows remote attackers to manipulate the 'url' argument, potentially causing the server to make unintended requests. Public exploit code is available, but no confirmed exploitation in the wild has been reported. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or official fix information is provided in the data.