OpenSupports CVE-2025-10695

No special configuration is required beyond the product being deployed with network-reachable exposure: the two diagnostic endpoints are shipped with permission => 'any', so exploitation works against default installations of OpenSupports 4.11.0 without authentication or user interaction. The practical limiting factors are (1) the OpenSupports instance (and specifically these diagnostic endpoints) must be reachable by the attacker over the network, and (2) impact is bounded to SSRF-style internal network scanning and service interaction - there is no direct data modification or availability impact, and value derived depends on the sensitivity of internal services reachable from the backend.

This is a genuine but moderate-priority issue, best characterized as a high-signal-but-low-urgency flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which aligns perfectly with the description of two diagnostic endpoints exposed with permission => 'any'. However, the technical impact is deliberately scoped low: only VC:L (limited confidentiality, i.e. internal reconnaissance / service interaction) with VI:N and VA:N, and no scope change to subsequent systems (SC:N/SI:N/SA:N), yielding the base score of 6.9. The supporting signals pull toward lower real-world urgency: EPSS is only 0.05% (16th percentile), indicating very low predicted exploitation volume, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. The one elevating factor is that public exploit code exists (Fluid Attacks advisory), making opportunistic use plausible. There is no contradiction between the CVSS vector and the description - both clearly describe remote unauthenticated SSRF. Net assessment: a legitimately exploitable unauthenticated SSRF with a working POC, but constrained to a niche product with low measured exploitation probability, so it warrants timely patching rather than crisis response.

A remote, unauthenticated attacker sends a request to one of the two exposed diagnostic endpoints (permission => 'any') supplying an internal destination, causing the OpenSupports backend to initiate a connection to that target. The attacker uses this to map internal hosts/ports and interact with internal-only services that are otherwise unreachable from the internet. A public proof-of-concept exploit exists via the Fluid Attacks advisory, lowering the barrier to opportunistic abuse.