EUVD-2025-200216Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-only import feature requires high privileges; scope changes because outbound requests reach internal systems; no confidentiality impact on the vulnerable system itself.
Primary rating from Vendor (64c5ae8f-7972-4697-86a0-7ada793ac795).
CVSS VectorVendor: 64c5ae8f-7972-4697-86a0-7ada793ac795
Lifecycle Timeline
5DescriptionCVE.org
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of
ObjectPlanet Opinio 7.26 rev12562 on
Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests
to an arbitrary destination.
AnalysisAI
Blind Server-Side Request Forgery in ObjectPlanet Opinio 7.26 (rev12562) enables an authenticated high-privilege user to coerce the survey server into issuing outbound HTTP GET requests to arbitrary internal or external destinations via crafted survey-import payloads. Because the SSRF is blind, the attacker receives no response body, constraining practical impact to internal network probing and side-effect triggering on reachable internal endpoints. EPSS is 0.05% at the 15th percentile, no KEV listing exists, and no public exploit code has been identified.
Technical ContextAI
ObjectPlanet Opinio (CPE: cpe:2.3:a:objectplanet:opinio:7.26:*:*:*:*:*:*:*) is a web-based survey management platform. CWE-918 (Server-Side Request Forgery) arises when a server-side application fetches a user-supplied URL without sufficient validation, causing the request to originate from the server rather than the client. In Opinio's survey-import feature, import request parameters can be manipulated to embed attacker-controlled destination URLs, which the server fetches via HTTP GET on behalf of the requester. The 'blind' qualifier means the server's response to that outbound request is not returned to the attacker, limiting utility to inferring internal port/service availability through timing, response size differences, or triggering unintended behavior on internal HTTP endpoints such as cloud metadata services.
RemediationAI
A specific patched version is not independently confirmed from the available input data; consult the ObjectPlanet Opinio changelog at https://www.objectplanet.com/opinio/changelog.html and upgrade to any revision beyond rev12562 that addresses this issue. As interim compensating controls, restrict access to the survey-import feature to the smallest possible set of trusted administrator accounts, enforcing role-based access controls within Opinio. Apply egress firewall rules on the Opinio application server to block or allowlist outbound HTTP/HTTPS connections to only known legitimate external survey sources; this prevents the server from reaching internal metadata endpoints (e.g., 169.254.169.254) or other sensitive internal services. Monitor application and network logs for anomalous outbound HTTP GET patterns originating from the Opinio process. Disabling the import feature entirely is the most effective workaround but disrupts survey migration workflows.
Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to
In ObjectPlanet Opinio before 7.6.4, there is XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely expl
Stored cross-site scripting in ObjectPlanet Opinio 7.26 rev12562 allows a high-privileged attacker to inject persistent
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today