CVE-2023-45152

Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.

• CWE-918
• CWE-918

• https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295Patch
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppfExploit, Third Party Advisory
• https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295Patch
• https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppfExploit, Third Party Advisory

Published

Oct 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45147Discourse is an open source community platform. In affected …3.1
• CVE-2023-45148Nextcloud is an open source home cloud server. When Memcache…4.3
• CVE-2023-45149Nextcloud talk is a chat module for the Nextcloud server pla…4.3
• CVE-2023-4515In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-45150Nextcloud calendar is a calendar app for the Nextcloud serve…4.3
• CVE-2023-45151Nextcloud server is an open source home cloud platform. Affe…8.8
• CVE-2023-45158An OS command injection vulnerability exists in web2py 2.24.…9.8
• CVE-2023-451591E Client installer can perform arbitrary file deletion on p…8.4
• CVE-2023-4516 A CWE-306: Missing Authentication for Critical Function vul…7.8
• CVE-2023-45160In the affected version of the 1E Client, an ordinary user c…8.8
• CVE-2023-45161The 1E-Exchange-URLResponseTime instruction that is part of …7.2
• CVE-2023-45162Affected 1E Platform versions have a Blind SQL Injection vul…9.8