Hippo4J
Monthly
Server-side request forgery in Hippo4j through 1.5.0 allows an authenticated user of the Hippo4j server console to force the application to issue outbound HTTP GET requests to arbitrary hostnames and ports, because four ThreadPoolController endpoints accept a clientAddress parameter without validation. Affected deployments are those running the Hippo4j console with reachable internal services or cloud metadata endpoints (for example 169.254.169.254); the CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact gated behind a valid console session (PR:L) with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact against cloud environments depends on whether the instance exposes a metadata service and on whether the affected endpoints return the fetched response body, which is not confirmed by the available source data.
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Hippo4j through 1.5.0 allows an authenticated user of the Hippo4j server console to force the application to issue outbound HTTP GET requests to arbitrary hostnames and ports, because four ThreadPoolController endpoints accept a clientAddress parameter without validation. Affected deployments are those running the Hippo4j console with reachable internal services or cloud metadata endpoints (for example 169.254.169.254); the CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact gated behind a valid console session (PR:L) with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact against cloud environments depends on whether the instance exposes a metadata service and on whether the affected endpoints return the fetched response body, which is not confirmed by the available source data.
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.