Description

A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customer_notice/Customer_noticeAction.java of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Eine kritische Schwachstelle wurde in zj1983 zz bis 2024-8 entdeckt. Davon betroffen ist die Funktion sendNotice der Datei src/main/java/com/futvan/z/erp/customer_notice/Customer_noticeAction.java der Komponente HTTP Request Handler. Dank der Manipulation des Arguments url mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

Classification

CVE ID: CVE-2025-1833

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.3

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Products

Vendor: zj1983

Product: zz

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 8.89% (scored less or equal to compared to others)

EPSS Date: 2025-03-31 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1833
https://vuldb.com/?id.298100
https://vuldb.com/?ctiid.298100
https://vuldb.com/?submit.504833
https://github.com/caigo8/CVE-md/blob/main/zz/zz_2024_8%E5%90%8E%E5%8F%B0SSRF.md

Timeline