CVE-2021-47703 OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php
Unauthenticated attackers can exploit SSRF in OpenBMCS to bypass firewalls, enumerate internal networks, and hijack sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47703?
CVE-2021-47703 is a medium-severity server-side request forgery vulnerability in OpenBMCS, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through the affected application, allowing hijacking of current sessions. Attackers can specify an external domain in the 'ip' parameter to force the application to make an HTTP request to an arbitrary destination host.
Weakness: CWE-918
Which versions are affected by CVE-2021-47703?
It affects 1 product.
Products include Openbmcs Openbmcs.
How do I fix CVE-2021-47703?
No fix has been published for CVE-2021-47703 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-47703 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47703 exists.
Other vulnerabilities in OpenBMCS
Sources
Also known as GHSA-hff9-gq78-65hw.