CVE-2022-23071

6.5 mediumEPSS 1.0%

Medium (6.5) in tandoor recipes. EPSS 1.0% chance of exploitation in the next 30 days.

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2022-06-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tandoor:recipes

References

https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c
https://www.mend.io/vulnerability-database/CVE-2022-23071
https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c
https://www.mend.io/vulnerability-database/CVE-2022-23071

Check your stack JSON