CVE-2025-64327

Katalog CVE

CVSS 5.3 · Medium EPSS 0,35%

Kerentanan Server-Side Request Forgery (SSRF) pada matiasdesuu thinkdashboard. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.

Rincian

Terbit di NVD

6 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78 exploit · advisory vendor
• https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae patch
• https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8 release notes