CVE-2025-9821

Katalog CVE

CVSS 2.7 · Low EPSS 0,30%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 2.7 (Low) menurut mautic.org.

Deskripsi (NVD)

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/  for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html  for more information on SSRF and its fix.

Rincian

Terbit di NVD

3 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

2.7 (Low), sumber mautic.org
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69