CVE-2025-2835 - zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

Back Back to CVE browser

MEDIUM

zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

Published Mar 27, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Zhangyd-C Product OneBlog Default
unknown
Affected
- 2.3.0
- 2.3.1
- 2.3.2
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.3.9

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zhangyd-C	OneBlog	unknown	Affected 2.3.0 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.3.7 2.3.8 2.3.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8270
Advisory
https://github.com/zhangyd-c/OneBlog/issues/36
exploitissue-trackingIssue Tracking
https://github.com/zhangyd-c/OneBlog/issues/36#issue-2923097259
exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.301471
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.301471
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.521815
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8270		Advisory
https://github.com/zhangyd-c/OneBlog/issues/36		exploitissue-trackingIssue Tracking
https://github.com/zhangyd-c/OneBlog/issues/36#issue-2923097259		exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.301471		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.301471		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.521815		third-party-advisoryThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulDB

Published Mar 27, 2025

Updated Mar 27, 2025

Reserved Mar 26, 2025

Link CVE-2025-2835

CISA Vulnrichment

Updated Mar 27, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-2835

Red Hat

No data

ENISA EUVD

Assigner VulDB

Published Mar 27, 2025

Updated Mar 27, 2025

Link EUVD-2025-8270

GitHub

No data