Vulnerability · Published Jul 20, 2022 · Assigned by twcert
CVE-2022-32457Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)
Medium 5.3
In plain English
A medium-severity server-side request forgery in BPM from Data Systems Consulting Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.8%top 42.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Data Systems Consulting Co., Ltd. | BPM | unspecified – through 5.8.6.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb x_refsource_MISC