CVE-2025-15098
YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 26, 2025
- Updated
- Oct 27, 2026
- Reserved
- Dec 25, 2025
Description
A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing a manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. It is recommended to upgrade the affected component. The vendor confirms: "[W]e retain BPM's configured HTTP integration capability, including legitimate internal-service calls, and the existing RestTemplate client. We have added an optional server-side hostname/IP allow/deny check in Boot and Cloud master-jdk17."
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
yudao-cloudYunaiV |
|
References
- VDB-338429 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgeryvdb-entrytechnical-description
- VDB-338429 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2025-15098 | CVE Analysis and Reportthird-party-advisory
- Submit #710170 | YunaiV YuDao Cloud <=v2025.11 Server-Side Request Forgerythird-party-advisory
- https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.mdrelated
- https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-conceptexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.