CVE-2022-1239

The HubSpot All-In-One Marketing plugin versions prior to 8.8.15 contain a server-side request forgery vulnerability in its proxy REST endpoint. The endpoint fails to properly validate the proxy URL parameter, enabling users with post editing privileges (typically contributors and higher roles) to exploit this weakness. An attacker with these permissions could leverage the flaw to make unauthorized requests to internal or external systems on behalf of the server.

Based on public CVE data (MITRE/NVD).