CVE-2025-52163
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An SSRF vulnerability in the TunnelServlet component of Agorum core open v11.9.2 and v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.
Risk Assessment
The risk involves potential internal network scanning, access to confidential services, and data theft, compromising system integrity and confidentiality.
Recommendation
Immediately update to a patched version and implement network traffic filtering and request validation in the TunnelServlet component.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.