A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/uti…

Published:

2 juni 2026 om 22:00:00

Alert date:

3 juni 2026 om 23:00:33

Source:

nvd.nist.gov

Web Technologies, Enterprise Applications

A server-side request forgery vulnerability was discovered in CRMEB Java version 1.4. The vulnerability affects the RestTemplate.getForEntity function in the RestTemplateUtil.java file within the base64 QR code endpoint component. Attackers can manipulate the URL argument to perform SSRF attacks remotely. The exploit has been publicly disclosed and is available for use. The project maintainers were notified through an issue report but have not yet responded to the security concern.

Technical details

Mitigation steps:

Affected products:

CRMEB Java