CVE-2025-10695

MediumCVSS 5.3

Published: 03/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

OpenSupports 4.11.0 exposes two unauthenticated diagnostic endpoints with permission 'any', allowing arbitrary backend-initiated network connections to an attacker-supplied destination. This enables unauthenticated SSRF for internal network scanning and service interaction.

Risk Assessment

An unauthenticated attacker can use the application to probe and interact with internal services, potentially leading to information disclosure or further escalation. The risk mainly affects environments where OpenSupports can reach internal networks.

Recommendation

Update OpenSupports to a version later than 4.11.0 if available, or restrict access to the diagnostic endpoints and segment the network to limit SSRF reach.

Other vulnerabilities in OpenSupports

CVE-2025-10692High
The endpoint POST /api/staff/get-new-tickets in OpenSupports 4.11.0 concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. An authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, bypass department scoping, and disclose tickets beyond their intended access.

Original NVD description (English source)

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS