Description
It was determined that the web application performs a server-side rendering/processing of a user supplied data in insecure way. An unauthenticated attacker could use this vulnerability to send requests to restricted services. Also, in certain cases, it may be possible to read arbitrary local files of the system.
Remediation
Sanitize user's data
References
Related Vulnerabilities
Deserialization of Untrusted Data (Java JSON Deserialization) Fastjson
Ivanti EPM SQLi RCE (CVE-2024-29824)
DNN (DotNetNuke) CMS Cookie Deserialization RCE CVE-2017-9822
WordPress Plugin Dropbox Folder Share Server-Side Request Forgery (1.9.7)
XWiki Server-Side Request Forgery (SSRF) Vulnerability (CVE-2023-48240)