High severity8.1NVD Advisory· Published Feb 26, 2024· Updated Jul 9, 2026

CVE-2024-22873

Description

Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tencent/Blueking Configuration Management Database
cpe:2.3:a:tencent:blueking_configuration_management_database:*:*:*:*:*:*:*:*
Range: >=3.2.2,<=3.9.47
Tencent/Blueking CMDBdescription
Tencent/Blueking CMDBllm-fuzzy
Range: v3.2.x to v3.9.x

Patches

Vulnerability mechanics

References

sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6aenvdExploit
gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000