The vulnerability lies in CordysCRM’s TokenService endpoint, where manipulating the mkAddress parameter causes the server to issue arbitrary outbound HTTP requests. This allows an attacker to make the server contact internal services or exfiltrate data through the server’s outbound traffic. The flaw is classified as a Server‑Side Request Forgery (CWE‑918) and carries a CVSS score of 5.3, indicating a moderate impact on confidentiality and availability if exploited.

CordysCRM versions 1.4.1 and earlier are affected. No later releases are listed in the CVE data, so any deployment running 1.4.1 or an earlier build must be treated as vulnerable.

The EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, suggesting a low background exploitation rate. However, the exploit is publicly available and can be triggered remotely by sending a specially crafted request to the TokenService endpoint, giving an attacker the ability to reach otherwise protected internal resources. Successful exploitation would enable the attacker to perform arbitrary HTTP requests from the host, potentially exposing sensitive data or enabling further lateral movement.