Paper/Archive/CVE-2025-60279

CVE-2025-60279

mitre — A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrar…

EPSS 0.4%public exploit CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (ADP)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 37.4.374 × 207.5 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API. An attacker can leverage this to enumerate open ports based on response discrepancies and interact with internal services.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refowasp.org/www-community/attacks/Server_Side_Request_Forgery refgithub.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-60279.pdf