A vulnerability in crmeb crmeb_java version 1.4 allows an attacker to manipulate the URL parameter passed to RestTemplate.getForEntity in the Base64 QRCode endpoint. This leads to a server‑side request forgery (CWE‑918) that can be triggered remotely, enabling the attacker to force the application to send requests to arbitrary internal or external destinations, potentially exposing sensitive data or facilitating further attacks.

The affected product is the crmeb crmeb_java package, version 1.4, specifically the RestTemplateUtil utility within the Base64 QRCode component.

The CVSS score of 6.9 indicates moderate to high severity, but the exploit is publicly known and executable without privileged access, making it a realistic threat. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet, but the remote SSRF vector remains dangerous. An attacker likely needs only to send a crafted payload to the vulnerable endpoint to trigger internal requests; success depends on application network configuration.