Jobops
Monthly
Server-side request forgery in JobOps through 0.13.1 lets a caller submit an arbitrary url value to the POST /api/manual-jobs/fetch handler and have the server fetch internal destinations, with the response body returned to the caller, exposing loopback services, private-range hosts, and cloud instance metadata such as the 169.254.169.254 endpoint. In a standard deployment the request must carry valid authentication (PR:L per the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), but when the instance is running in demo mode unauthenticated clients can trigger the identical request, which is the configuration that removes the authentication barrier. Impact is confidentiality-only at 7.1 (no integrity or availability effect, no user interaction), and exploitation succeeds only if the target internal destination is network-reachable from the JobOps server; no public exploit code was identified at time of analysis, although a public technical writeup describing the flaw exists, and no KEV listing appears in the provided intelligence.
Server-side request forgery in JobOps through 0.13.1 lets a caller submit an arbitrary url value to the POST /api/manual-jobs/fetch handler and have the server fetch internal destinations, with the response body returned to the caller, exposing loopback services, private-range hosts, and cloud instance metadata such as the 169.254.169.254 endpoint. In a standard deployment the request must carry valid authentication (PR:L per the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), but when the instance is running in demo mode unauthenticated clients can trigger the identical request, which is the configuration that removes the authentication barrier. Impact is confidentiality-only at 7.1 (no integrity or availability effect, no user interaction), and exploitation succeeds only if the target internal destination is network-reachable from the JobOps server; no public exploit code was identified at time of analysis, although a public technical writeup describing the flaw exists, and no KEV listing appears in the provided intelligence.