CVE-2025-13872
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-04
Assigner: TCS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| objectplanet | opinio | 7.26 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms. It allows an attacker to make the server perform HTTP GET requests to arbitrary destinations by sending specially crafted import requests.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to make the server send HTTP requests to arbitrary locations, potentially accessing internal or protected resources that the attacker cannot reach directly. This can lead to information disclosure or interaction with internal systems without authorization.