CVE-2025-14518

Katalog CVE

CVSS 9.8 · Critical EPSS 0,35%

Kerentanan Server-Side Request Forgery (SSRF) pada powerjob. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Rincian

Terbit di NVD

11 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.335856 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.702896 advisory pihak ketiga · vdb entry
• https://github.com/PowerJob/PowerJob/issues/1144 exploit · issue tracking
• https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002 exploit · issue tracking
• https://github.com/PowerJob/PowerJob/
• https://vuldb.com/?ctiid.335856 permissions required · vdb entry