CVE-2026-49345

{
  "id": "CVE-2026-49345",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-19T20:16:18.663",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue."
    },
    {
      "lang": "es",
      "value": "Mercator es una aplicación web de código abierto que permite el mapeo del sistema de información. Antes de la versión 2025.05.19, una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) existe en el panel de configuración CVE de Mercator (’/admin/config/parameters’). El método ’testProvider()’ en ’ConfigurationController’ pasa la entrada proporcionada por el usuario directamente a ’curl_init()’ sin validar el esquema, el nombre de host o la dirección IP de destino. Un usuario autenticado con el permiso ’configure’ puede forzar al servidor Mercator a emitir peticiones de red salientes arbitrarias. El sufijo ’/api/dbInfo’ añadido a la URL puede ser omitido inyectando un carácter de fragmento ’#’ (p. ej., ’http://TARGET/PATH#’), permitiendo el control total sobre la URL de destino. No se aplica ninguna lista blanca de esquemas, lista blanca de hosts o bloqueo de IP privadas/loopback. El esquema ’telnet://’ puede ser utilizado para el escaneo interno de puertos; el esquema ’gopher://’ permite la interacción con servicios internos no autenticados (Redis, Memcached), lo que podría llevar a la ejecución remota de código bajo condiciones de despliegue específicas. La versión 2025.05.19 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sourcentis",
          "product": "mercator",
          "versions": [
            {
              "version": "< 2025.05.19",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T13:58:39.217300Z",
          "id": "CVE-2026-49345",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}