SSRF in Stimulsoft Designer
CVE-2023-25262
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.009 (55.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Stimulsoft Designer — versions 2023.1.3, 2023.1.4
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- af854a3a-2127-422b-91ae-364da2661108 (Vendor Advisory)
- cve@mitre.org (Broken Link)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-25262?
- CVE-2023-25262 is a high-severity vulnerability in Stimulsoft Designer, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2023-03-28.
- How severe is CVE-2023-25262?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-25262 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.