CVE-2025-36845

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-36845
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://smartoffice.expert/en Product
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eveo:urve_web_manager:27.02.2025:*:*:*:*:*:*:*
History

12 Sep 2025, 18:09

Type Values Removed Values Added
CPE cpe:2.3:a:eveo:urve_web_manager:27.02.2025:*:*:*:*:*:*:*
First Time Eveo
Eveo urve Web Manager
Summary
  • (es) Se detectó un problema en Eveo URVE Web Manager el 27/02/2025. El endpoint /_internal/redirect.php permite server-side request forgery (SSRF). El endpoint toma una URL como entrada, envía una solicitud a esta dirección y refleja el contenido en la respuesta. Esto se puede usar para solicitar endpoints a los que solo puede acceder el servidor de aplicaciones.
References () https://smartoffice.expert/en - () https://smartoffice.expert/en - Product
References () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt - () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt - Exploit, Third Party Advisory

21 Jul 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.6
CWE CWE-918

21 Jul 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-21 18:15

Updated : 2025-09-12 18:09

NVD link : CVE-2025-36845

Mitre link : CVE-2025-36845

CVE.ORG link : CVE-2025-36845

JSON object : View

Products Affected

eveo

  • urve_web_manager
CWE
CWE-918

Server-Side Request Forgery (SSRF)