CVE-2025-11674
BaseFortify
Publication date: 2025-10-13
Last updated on: 2025-10-14
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| piextract | soop-clm | 5.2 |
| piextract | soop-clm | 5.3 |
| piextract | soop-clm | 6.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11674 is a Server-Side Request Forgery (SSRF) vulnerability in SOOP-CLM developed by PiExtract. It allows privileged remote attackers to trick the server into making unauthorized requests, which can lead to reading server files or probing internal network information. This means an attacker with administrative privileges can exploit this flaw to access sensitive data or gather information about the internal network. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a privileged remote attacker to read sensitive server files or gather information about your internal network. This could lead to exposure of confidential data and potentially aid further attacks by revealing internal network structure or sensitive information stored on the server. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to update SOOP-CLM to version 6.0.0 or later. [1, 2]