CVE-2023-45152 Information

Description

Engelsystem is a shift planning system for chaos events. A Blind SSRF in the \Import schedule\ functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary they should utilize additional authentication.

Reference

https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295 https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf