What’s Vulnerable › Vulnerabilities

CVE-2023-45152: Blind Server Side Request Forgery (SSRF) in remote schedule import feature in Engelsystem

• Severity: low (CVSS 2.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-17 · updated 2026-06-17
• Weakness: CWE-918

Description

Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.

Affected products

• engelsystem: before 2023-09-18 — fixed in 2023-09-18

How to fix

Upgrade to a fixed version: engelsystem 2023-09-18. Check the vendor advisory for mitigations.

References

• https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf
• https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf

Get alerted when CVE-2023-45152 or the next vulnerability affects your stack