CVE-2025-10695

Summary

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction.

This issue affects OpenSupports: 4.11.0.

Affected Software

Weaknesses

• CWE-918: CWE-918 Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://fluidattacks.com/advisories/freer

References

• https://fluidattacks.com/advisories/freer
• https://github.com/opensupports/opensupports

• ←Previous
• Next→