A Server‑Side Request Forgery vulnerability exists in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0. When an authenticated attacker crafts a suitable GET request, the application forwards that request to arbitrary internal or external addresses. This allows the attacker to probe internal network resources and discover services, which can serve as a foothold for further exploitation. The weakness is a classic SSRF flaw, classified under CWE‑918, and it compromises confidentiality and integrity of internal infrastructure without requiring any privilege escalation beyond the credentials used in the application.

SpringBlade version 4.8.0 is affected. No other vendor or product versions are listed, so any deployment of this particular release should be regarded as vulnerable.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploits. The CVSS score of 5 indicates a moderate severity. However, the authenticated nature of the flaw means that any user with legitimate access to the platform can initiate the internal scans, raising the risk level to moderate‑high for organizations that rely on SpringBlade for critical operations. The attack vector is a crafted HTTP GET request to the vulnerable endpoint; no additional prerequisites are mentioned beyond standard authentication.