medium5.3
CVE-2025-10695
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination.
Impact
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensupports | Opensupports | Version 4.11.0 |