EUVD-2025-19617Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
Analysis
zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
Technical ContextAI
Server-Side Request Forgery allows an attacker to induce the server to make HTTP requests to arbitrary destinations, including internal services. This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918).
RemediationAI
Validate and whitelist allowed URLs and IP ranges. Block requests to internal/private IP ranges. Use network segmentation to limit server-side request scope.
A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass t
ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file. Rat
An issue was discovered in ZrLog 2.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
zrlog v2.1.0 has a vulnerability with the permission check. Rated medium severity (CVSS 5.7), this vulnerability is remo
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today