CVE-2022-24862: Server-Side Request Forgery in Databasir

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-20 · updated 2026-06-17
Weakness: CWE-918

Description

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the download verification process of a JDBC driver the corresponding JDBC driver download address will be downloaded first, but this address will return a response page with complete error information when accessing a non-existent URL. Attackers can take advantage of this feature for SSRF.

Affected products

vran-dev databasir: 1.0.1

References

https://github.com/vran-dev/databasir/releases/tag/v1.0.2
https://github.com/vran-dev/databasir/security/advisories/GHSA-r8m9-r74j-vc6m
https://github.com/vran-dev/databasir/releases/tag/v1.0.2
https://github.com/vran-dev/databasir/security/advisories/GHSA-r8m9-r74j-vc6m

Get alerted when CVE-2022-24862 or the next vulnerability affects your stack