A server‑side request forgery flaw in Sunbird‑Ed SunbirdEd‑portal version 1.13.4 allows an attacker to control the URL that the application requests from the network. By supplying an arbitrary URL, the vulnerable code can force the portal to reach internal or external resources, thereby exposing data that should not be publicly accessible. The weakness corresponds to CWE‑918 and results in the disclosure of sensitive information.

The vulnerability is confined to the Sunbird‑Ed SunbirdEd‑portal product at release 1.13.4. No other vendors or product variants are listed, and the CPE data confirms a single affected instance.

The CVSS score of 7.5 indicates a high severity, while the EPSS score below 1% suggests that exploitation is unlikely at present. The vulnerability is not catalogued in CISA’s Known Exploited Vulnerabilities list. The likely attack path involves an attacker crafting a request containing a malicious URL to activate the SSRF, which would allow data retrieval from the portal’s execution environment. The impact would be limited to the data exposed through the portal’s outbound reach, but it poses a significant confidentiality risk if internal resources can be accessed.