The vulnerability appears in the Swagger3ParserApiDefinition.testUrlTimeout function of MeterSphere’s Swagger3 Parser component. By manipulating the swaggerUrl argument, an attacker can cause the MeterSphere server to issue HTTP requests to arbitrary URLs. This server‑side request forgery (SSRF) can be exploited remotely, allowing an attacker to interact with external services or internal hosts that the server can reach. While the CVE description does not detail the specific outcomes, the exploitation mechanism could lead to data exfiltration or accidental discovery of internal resources.

The affected product is fit2cloud MeterSphere, specifically versions up to 3.6.9‑lts, where the vulnerable Swagger3ParserApiDefinition.java resides in the backend/parser/api/dataimport directory of the Swagger3 Parser module.

With a CVSS base score of 5.3 the vulnerability is of moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating an uncertain exploitation probability. The public exploit indicates that a remote attacker can craft a malicious request to a reachable MeterSphere endpoint and trigger the SSRF path. If the endpoint is exposed to the internet, the attacker could direct the server to external or internal destinations by supplying arbitrary URLs.