PT-2025-50233 · Openbmc · Openbmc

Published 2025-12-09 · Updated 2025-12-19 · CVE-2021-47703

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4

Description The software contains an unauthenticated Server-Side Request Forgery (SSRF) issue. This allows attackers to bypass firewalls and perform service and network enumeration on the internal network. Attackers can exploit this by providing an external domain in the ip parameter, causing the application to make HTTP requests to arbitrary destinations. This can lead to hijacking of current sessions.

Recommendations Apply a fix or update to address the unauthenticated SSRF vulnerability in the affected version. As a temporary workaround, restrict or monitor outbound network requests made by the application.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-47703

Affected Products

Openbmc

References · 8

• 🔥 https://exploit-db.com/exploits/50670 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5694.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47703 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47703 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998732810170073518 · Twitter Post
• https://openbmcs.com · Note
• https://vulncheck.com/advisories/openbmcs-server-side-request-forgery-ssrf-via-phpqueryphp · Note
• https://t.me/cveNotify/146396 · Telegram Post