CVE-2022-32457

MEDIUM

Digiwin Business Process Management < 5.8.8.1 - Unauthenticated Server-Side Request Forgery via URL Parameter

Title source: llm
STIX 2.1

Description

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html

Scores

CVSS v3 5.3
EPSS 0.0068
EPSS Percentile 47.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
digiwin/business_process_management < 5.8.8.1
Published Jul 20, 2022
Tracked Since Feb 18, 2026