CVE-2025-13872

Critical

Published: 02/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

Risk Assessment

The risk includes potential use of the server to attack internal network resources, which could lead to disclosure of sensitive information or further compromise.

Recommendation

It is recommended to update to the latest version of the software and restrict access to the survey import feature to trusted users only.

Original NVD description (English source)

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.