Arcreel
Monthly
ArcReel 0.32.0, 0.33.0 and 0.34.0 contain a server-side request forgery flaw in the Provider Test-Connection endpoint at /api/v1/providers/{id}/test. An attacker who holds an authenticated session with enough privilege to invoke that test-connection feature can manipulate the destination so the ArcReel server issues a request on their behalf, potentially reaching internal services and exposing low-sensitivity information. A public proof-of-concept reference exists but is not verified as working exploit code, no CISA KEV entry is recorded, and the vendor did not respond to early contact; the assessed impact is limited to low confidentiality with no integrity or availability effect.
ArcReel 0.32.0, 0.33.0 and 0.34.0 contain a server-side request forgery flaw in the Provider Test-Connection endpoint at /api/v1/providers/{id}/test. An attacker who holds an authenticated session with enough privilege to invoke that test-connection feature can manipulate the destination so the ArcReel server issues a request on their behalf, potentially reaching internal services and exposing low-sensitivity information. A public proof-of-concept reference exists but is not verified as working exploit code, no CISA KEV entry is recorded, and the vendor did not respond to early contact; the assessed impact is limited to low confidentiality with no integrity or availability effect.