CyberRota Analysis
AI-GeneratedThe vulnerability allows remote authenticated users to exploit server-side request forgery (SSRF) in Scripta eScriptorium, enabling them to make arbitrary HTTP requests to internal services, including sensitive cloud instance metadata. This poses a significant risk as it could lead to unauthorized access to internal resources and data leakage. Organizations using affected versions of Scripta eScriptorium should prioritize patching this vulnerability to mitigate potential exploitation.
Original NVD Description
Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied