EUVD-2026-22120
GHSA-46m9-h86m-p3xh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires high-privilege admin authentication; SSRF yields only low confidentiality, integrity, and availability impact with no scope change.
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in HummerRisk up to 1.5.0. This vulnerability affects the function ServerService.addServer of the file ServerService.java of the component Video File Download URL Handler. Such manipulation of the argument streamIp leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
Technical ContextAI
HummerRisk is a Java-based cloud-native security management platform. The vulnerable component is the Video File Download URL Handler within ServerService.java, specifically the addServer method (CWE-918: Server-Side Request Forgery). The root cause is insufficient validation of the streamIp input parameter before it is used to construct and issue outbound server-side HTTP requests. CWE-918 arises when user-supplied data controls the target of a server-initiated request, enabling attackers to pivot through the server to reach otherwise inaccessible internal network resources, cloud metadata endpoints (e.g., 169.254.169.254), or external destinations. The CPE string cpe:2.3:a:n/a:hummerrisk:*:*:*:*:*:*:*:* reflects that no authoritative CPE vendor identifier has been assigned, consistent with the vendor's non-responsiveness to disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was contacted prior to public disclosure and did not respond. Organizations running HummerRisk 1.0 through 1.5.0 should apply the following compensating controls. First, restrict access to the HummerRisk administrative interface to trusted internal IP ranges only using network-level ACLs or a WAF, reducing the attack surface even though PR:H is required. Second, deploy egress filtering on the HummerRisk host to block outbound requests to cloud metadata endpoints (e.g., 169.254.169.254/32) and RFC-1918 address ranges not required for legitimate operation - this directly limits the SSRF blast radius; note this may break integrations with internal services if not carefully scoped. Third, monitor outbound HTTP requests from the HummerRisk application server for anomalous destinations. The public POC is referenced at https://github.com/ccccccctiiiiiiii-lab/public_exp/issues/1 and VulDB entry https://vuldb.com/vuln/357141. Organizations should evaluate whether deployment of this product is justified until a vendor-issued fix is released.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today