The flaw allows a malicious actor to direct the server to perform outbound HTTP requests to arbitrary URLs, which can expose internal resources or gathered data to the attacker. This type of compromise can lead to the disclosure of sensitive information, especially if internal services are contacted during the forged request. The vulnerability is classified as CWE-918, indicating the absence of proper validation for externally supplied request targets. The CVSS score of 8.8 reflects the full impact on confidentiality and integrity stemming from an unrestricted network call initiated by the server.

Progress Software’s @progress/sitefinity-nextjs-sdk Node.js package is affected. Versions 15.1.8326 through 15.4.8637 contain the flaw. Systems that run any of those releases without updating are susceptible. No other vendors or versions are listed in the advisory.

With a base score of 8.8, any environment running the vulnerable SDK is at high risk. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the absence of an EPSS rating does not diminish the inherent danger. The attack surface requires a remote attacker to exploit a component that executes the SDK’s rendering logic. If the renderer is exposed, the attacker can trigger forged requests by manipulating the data processed by the SDK. The vulnerability’s high severity and potential for wide information leakage necessitate immediate attention.