CVE-2023-45152

    Dashboard / Vulnerabilities / CVE-2023-45152

    CVE-2023-45152

    Published: 16 Oct 2023Last Modified: 28 Oct 2026

    Summary: Blind Server Side Request Forgery (SSRF) in remote schedule import feature in Engelsystem

    Details: Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45152.json, https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf, https://nvd.nist.gov/vuln/detail/CVE-2023-45152, https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ee7d30b33

    Affected versions

    v3.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-45152 | CVE-DB