CVE-2023-25262

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25262
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://stimulsoft.com Vendor Advisory
http://stimulsoft.com Vendor Advisory
https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM Broken Link
https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM Broken Link
https://cves.at/posts/cve-2023-25262/writeup/ Exploit Third Party Advisory
https://cves.at/posts/cve-2023-25262/writeup/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:stimulsoft:designer:2023.1.3:*:*:*:web:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:web:*:*:*
History

19 Feb 2025, 19:15

Type Values Removed Values Added
References (MISC) https://cves.at/posts/cve-2023-25262/writeup/ - Exploit, Third Party Advisory () https://cves.at/posts/cve-2023-25262/writeup/ - Exploit, Third Party Advisory
References (MISC) http://stimulsoft.com - Vendor Advisory () http://stimulsoft.com - Vendor Advisory
References (MISC) https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM - Broken Link () https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM - Broken Link

03 Apr 2023, 18:41

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://cves.at/posts/cve-2023-25262/writeup/ - (MISC) https://cves.at/posts/cve-2023-25262/writeup/ - Exploit, Third Party Advisory
References (MISC) https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM - (MISC) https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM - Broken Link
References (MISC) http://stimulsoft.com - (MISC) http://stimulsoft.com - Vendor Advisory
First Time Stimulsoft designer
Stimulsoft
CPE cpe:2.3:a:stimulsoft:designer:2023.1.3:*:*:*:web:*:*:*
cpe:2.3:a:stimulsoft:designer:2023.1.4:*:*:*:web:*:*:*
CWE CWE-918
Information

Published : 2023-03-28 01:15

Updated : 2025-02-19 19:15

NVD link : CVE-2023-25262

Mitre link : CVE-2023-25262

JSON object : View

Products Affected

stimulsoft

  • designer
CWE
CWE-918

Server-Side Request Forgery (SSRF)