Tencent Blueking CMDB Vulnerability: SSRF via Event Subscription Function
CVE-2024-22873

8.1HIGH

Key Information:

Vendor

Tencent

Status
Blueking Cmdb
Vendor
CVE Published:
26 February 2024

What is CVE-2024-22873?

A vulnerability has been identified in Tencent's Blueking CMDB versions 3.2.x through 3.9.x that manifests as a Server-Side Request Forgery (SSRF). This flaw arises within the event subscription functionality, specifically at the endpoint (/service/subscription.go). It permits attackers to exploit the system by sending carefully crafted POST requests, potentially gaining unauthorized access to internal network resources and services.

References

http://tencent.com
http://blueking.com
https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba2...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.