Progress Sitefinity Nextjs Sdk
Monthly
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.