CVE-2023-45152

Summary

CVE-2023-45152 is a Blind Server Side Request Forgery (SSRF) vulnerability affecting Engelsystem, a shift planning system for chaos events. This issue, located in the "Import schedule" functionality, enables attackers to perform a port scan against the local environment. The vulnerability has been rectified through commit ee7d33b, but if a patch isn't immediately deployable, system administrators are advised to ensure no HTTP(s) services listen on localhost or are accessible only from the host running Engelsystem software. If such services are essential, they must implement additional authentication measures to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.