CVE-2023-46736: espocrm

csirt@kutim:~/threat-intel/cve/CVE-2023-46736

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Server-Side Request Forgery (SSRF) pada espocrm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via the upload image from url api. Users who have access to `the /Attachment/fromImageUrl` endpoint can specify URL to point to an internal host. Even though there is check for content type, it can be bypassed by redirects in some cases. This SSRF can be leveraged to disclose internal information (in some cases), target internal hosts and bypass firewalls. This vulnerability has been addressed in commit `c536cee63` which is included in release version 8.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 5 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,36% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
espocrm	espocrm	Semua versi hingga 8.0.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/espocrm/espocrm/security/advisories/GHSA-g955-rwxx-jvf6 advisory vendor
https://github.com/espocrm/espocrm/commit/c536cee6375e2088f961af13db7aaa652c983072 patch
https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.