CVE-2023-24243: 
Homebrew vulnerability analysis and mitigation

CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability was discovered during a red team assessment on October 3, 2022, and was disclosed to the vendor on March 9, 2023. The vendor released a fixed version on March 14, 2023, and made a public announcement on June 13, 2023 (Vendor Advisory).

The vulnerability could force the application to serve files outside of the web server's "www" directory, potentially leading to requests being sent to a server of the attacker's choosing. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD).

A successful exploitation of this vulnerability could allow attackers to access files outside the intended web server directory and make unauthorized server requests. The vulnerability affects Windows/.NET editions of CData applications using the .NET Embedded Web server (Vendor Advisory).

The vulnerability has been patched in the following versions: CData Arc (V22.0.8473), CData API Server (V22.0.8500), and CData Sync (V22.0.8483). Users running previous versions should upgrade to the latest release to mitigate this vulnerability (Vendor Advisory).