Description
A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-16
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Patch ASAP
AI Analysis

Impact

A vulnerability in the glowxq‑oj ProblemCaseController.uploadTestcaseZipUrl method allows an attacker to supply a manipulated URL that the server will fetch, enabling server‑side request forgery (CWE‑918). The flaw can lead to the server making arbitrary HTTP or HTTPS requests to internal or external resources, potentially exposing sensitive internal data or providing a foothold for further attacks, but it is not a direct remote code execution vector.

Affected Systems

All released versions of glowxq‑oj up to commit 6f7c723090472057252040fd2bbbdaa1b5ed2393 are affected. No specific patch or fixed release is available and continuous delivery with rolling releases means newer commits may also contain the flaw until a remedial release is issued.

Risk and Exploitability

The CVSS v3.1 base score of 6.9 indicates moderate severity. The EPSS score is below 1 %, indicating a currently low likelihood of exploitation, although an exploit has been publicly released. The vulnerability is not listed in CISA's KEV catalog. Attackers can trigger the flaw remotely by sending crafted requests to the vulnerable endpoint.

Generated by OpenCVE AI on March 17, 2026 at 00:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or updated release as soon as available
  • If the uploadTestcaseZipUrl endpoint is not required, disable or remove it
  • Configure outbound request filtering or firewall rules to limit the server’s HTTP(S) calls
  • Monitor application logs for unexpected outbound requests
  • Maintain the application and underlying infrastructure with the latest updates

Generated by OpenCVE AI on March 17, 2026 at 00:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Glowxq
Glowxq glowxq-oj
Vendors & Products Glowxq
Glowxq glowxq-oj

Mon, 16 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Title glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Glowxq Glowxq-oj
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T20:05:01.576Z

Reserved: 2026-03-15T08:36:29.050Z

Link: CVE-2026-4200

cve-icon Vulnrichment

Updated: 2026-03-16T20:04:56.610Z

cve-icon NVD

Status : Deferred

Published: 2026-03-16T14:20:04.847

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-4200

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:00:50Z

Weaknesses