CVE-2022-32457 Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)
Unauthenticated attackers can perform blind SSRF to map internal networks via URL parameter flaws in Digiwin BPM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32457?
CVE-2022-32457 is a medium-severity server-side request forgery vulnerability in Data Systems Consulting Co., Ltd. BPM, published on 20 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
Weakness: CWE-918
Which versions are affected by CVE-2022-32457?
It affects 1 product.
Products include Digiwin Business Process Management.
How do I fix CVE-2022-32457?
No fix has been published for CVE-2022-32457 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-32457 being exploited?
There is no known exploitation of CVE-2022-32457 in the wild and no public exploit code.
Other vulnerabilities in Data Systems Consulting Co., Ltd. BPM
Sources
Also known as GHSA-87ww-2p7v-mc8x.