CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in the DistributionController.isValidHttpEndpoint function of yaojingang GEOFlow versions up to 2.1.0, allowing remote attackers to manipulate the endpoint_url argument. This could lead to unauthorized access to internal services and data. Organizations using affected versions should prioritize upgrading to version 2.1.1 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpoint_url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.1 is recommended to address this issue. The name of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. It is advisable to upgrade the affected component.