EUVD-2026-45432
GHSA-pg8h-hjrw-38c4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege auth; no scope change; no direct availability impact from request forgery alone.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
AnalysisAI
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Technical ContextAI
CordysCRM is a Java-based CRM application developed under the 1Panel-dev organization. The vulnerability resides in backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java, a class handling Single Sign-On integration with third-party identity or service endpoints. CWE-918 (Server-Side Request Forgery) describes a root cause where user-supplied input - here the mkAddress argument - is used to construct or influence outbound HTTP requests without adequate validation or allowlist enforcement. The affected CPE is cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:* covering all versions through 1.4.1. An SSRF flaw at this layer is particularly concerning because SSO service components often have elevated trust relationships with internal identity providers, token stores, or microservices, potentially amplifying the impact of a successful request-forgery attack beyond what the low CVSS scores suggest.
RemediationAI
No vendor-released patch has been confirmed at time of analysis - the project maintainer closed the vulnerability report (https://github.com/1Panel-dev/CordysCRM/issues/2685) without issuing a fix, citing incorrect reporting channel. Organizations running CordysCRM 1.4.1 or earlier should implement compensating controls immediately. The most effective control is to enforce an outbound allowlist on the server hosting CordysCRM, restricting egress HTTP/HTTPS requests to only the specific third-party endpoints required for SSO operations, which neutralizes SSRF impact even if the parameter is abused. Additionally, deploying a web application firewall or reverse proxy to validate or strip the mkAddress parameter before it reaches the application can mitigate exploitation without code changes, though this may break legitimate SSO integration if not carefully configured. Network segmentation to prevent the CordysCRM server from reaching sensitive internal infrastructure (metadata services, internal APIs, LDAP) reduces lateral movement potential. Monitor the upstream repository at https://github.com/1Panel-dev/CordysCRM/ for any future commits addressing this issue, as no official fix timeline has been communicated.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today