CVE-2024-34319
6.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-918
Impact
Unauthenticated attackers with network access can force the server to make arbitrary HTTP and DNS requests to reach internal services. This enables pivoting, internal reconnaissance, and potential tampering with internal endpoints.
Root cause
The application fails to validate the user-supplied serviceURL parameter before initiating outbound network requests.
Affected systems
ProPhoenix Law RMS v2022.2403.3.101
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Contact ProPhoenix for an updated build since fixed versions are not listed in public data; as an immediate mitigation, block the application server's outbound HTTP and DNS access to internal networks at your firewall or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.