EUVD-2026-70372
GHSA-x3wr-4g6m-p8j5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Operator auth required (PR:L); SSRF causes server to proxy requests to internal systems (S:C); confidentiality impact limited to probing and partial data read (C:L), not full system compromise.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
2DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.
AnalysisAI
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid OCSreports operator-level account (PR:L per CVSS 4.0); unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N) accurately reflects the primary risk profile: high confidentiality impact on the vulnerable system (server-side responses may carry sensitive data such as IAM credential material from cloud metadata APIs), with modest subsequent-system impact (SC:L, reflecting limited internal network probing). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all operator accounts and disable inactive ones; verify firewall rules prevent outbound connections from the OCSreports server to 169.254.169.254 (AWS metadata) and internal IP ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ocs Inventory Ng
View allRemote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authentica
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/Java
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or mani
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today