CVE-2023-51804 Server-side request forgery in n/a
A remote attacker can obtain sensitive information by manipulating the HTTP body URL in the Forest library's upload controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-51804?
CVE-2023-51804 is a high-severity server-side request forgery vulnerability in n/a, published on 13 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file.
Weakness: CWE-918
Which versions are affected by CVE-2023-51804?
It affects 1 product.
Products include Rymcu Forest.
How do I fix CVE-2023-51804?
No fix has been published for CVE-2023-51804 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-51804 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-51804 exists.
Other vulnerabilities in n/a
- CVE-2025-12925 rymcu forest UserDicController.java deleteDic authorization
- CVE-2025-63687 Missing authorization in n/a
- CVE-2025-12924 rymcu forest BankController.java GlobalResult authorization
- CVE-2026-2946 rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting
- CVE-2026-2947 rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting
Sources
Also known as GHSA-4fwh-vhv3-7xx7.