Loading vulnerability…
NL Portal Backend Libraries contain unauthenticated GraphQL form-definition resolvers that accept a caller-supplied Objecten-API URL and cause the backend to fetch that URL on the configured Objecten-API host while forwarding a privileged Objecten-API token. This creates a constrained server-side request forgery condition combined with missing authorization on the resolver. According to the provided advisory, affected functionality includes getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById. The issue is constrained because outbound requests are limited to the configured Objecten-API host, and arbitrary object reads are further limited by typed deserialization, but an attacker can still influence the request target on that host and induce authenticated backend requests.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById. Enforce authentication on these resolvers where feasible. Constrain backend outbound connectivity to the exact expected Objecten-API scheme, host, port, and path prefix. Reject full caller-supplied URLs and only permit server-constructed object URLs derived from validated UUIDs.Patch, then assume compromise.
nl.nl-portal:* to version 3.0.4 or later. Per the advisory, the fix removes the unauthenticated URL-based resolvers, replaces URL-based fetching with UUID-based retrieval on a fixed /api/v2/objects/{uuid} path, and introduces authenticated task-based form-definition retrieval. Also upgrade nl-portal-frontend-libraries to version 3.0.3 or later because the GraphQL changes are breaking.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.