What’s Vulnerable › Vulnerabilities

CVE-2024-22873

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-26 · updated 2026-07-09
• Weakness: CWE-918

Description

Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.

Affected products

• Tencent Blueking Configuration Management Database: from 3.2.2 through 3.9.47

References

• https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09
• https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4
• https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09
• https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4

Get alerted when CVE-2024-22873 or the next vulnerability affects your stack