Log in Start free

Vulnerability · Published May 23, 2025 · Assigned by mitre

CVE-2025-48739

Medium 4.6

In plain English

A medium-severity server-side request forgery in TheHive from StrangeBee. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)4.6Medium
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote authenticated attackers with admin permissions (allowing them to access specific API endpoints) to manipulate URLs to direct requests to unexpected hosts or ports. This allows the attacker to use a TheHive server as a proxy to reach internal or otherwise restricted resources. This could be exploited to access other servers on the internal network.

Affected products (as reported)

VendorProductVersions
StrangeBee TheHive 5.2.0 – before 5.2.165.3.0 – before 5.3.115.4.0 – before 5.4.105.5.0 – before 5.5.1

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L

References