CVE-2022-32457: Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-20 · updated 2026-06-17
Weakness: CWE-918

Description

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

Affected products

Digiwin Business Process Management: before 5.8.8.1 — fixed in 5.8.8.1

How to fix

Upgrade to a fixed version: Digiwin Business Process Management 5.8.8.1. Check the vendor advisory for mitigations.

References

https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html
https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html

Get alerted when CVE-2022-32457 or the next vulnerability affects your stack