Server-side Request Forgery Vulnerability in a+HRD by aEnrich Technology
CVE-2025-0584

5.3MEDIUM

Key Information:

Vendor

Aenrich Technology

Status
A+hrd
Vendor
CVE Published:
20 January 2025

What is CVE-2025-0584?

The a+HRD product from aEnrich Technology contains a Server-side Request Forgery vulnerability that can be exploited by unauthenticated remote attackers. By leveraging this security flaw, attackers can manipulate the server to make requests to internal network resources, potentially exposing sensitive data and enabling further exploitation of network services. Timely patching is essential to mitigate these risks and protect organizational integrity.

Affected Version(s)

a+HRD 0 <= 7.5

References

https://www.twcert.org.tw/tw/cp-132-8370-58eb5-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8371-1c17a-2.html
third-party-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.