cve.bz

CWE-918: Server-Side Request Forgery (SSRF), page 66

Filter

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

What the weakness is: CWE-918 at MITRE

Ask an AI about CWE-918

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-918: Server-Side Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/918.html and https://cve.bz/cve/cwe/918?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2023-28155EPSS 0.7%

    The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that…

  2. 7.5CVE-2023-27896EPSS 0.5%

    In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

  3. 7.5CVE-2023-27271EPSS 0.6%

    In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availabi…

  4. 7.4CVE-2023-26459EPSS 0.4%

    Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which…

  5. 7.5CVE-2023-27161EPSS 1.0%

    Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. This vulnerability allows attackers to access network resources and sensitive information via a crafted POST request.

  6. 4.9CVE-2023-25230EPSS 0.7%

    A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.

  7. 7.5CVE-2021-36396EPSS 1.4%

    In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

  8. 7.5CVE-2023-26492EPSS 1.0%

    Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass …

  9. 9.8CVE-2022-46973EPSS 0.8%

    Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.

  10. 4.3CVE-2023-20062EPSS 0.5%

    Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system. Cisco plans to relea…

  11. 9.8CVE-2022-37938EPSS 0.6%

    Unauthenticated server side request forgery in HPE Serviceguard Manager

  12. 8.8CVE-2023-1046EPSS 0.6%

    A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation of the argument url leads to server-side request forgery. It is possible to ini…

  13. 7.5CVE-2022-4492EPSS 0.6%

    The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS clie…

  14. 3.3CVE-2022-48321EPSS 0.3%

    Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.

  15. 8.8CVE-2021-33926EPSS 1.0%

    An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.…

  16. 6.5CVE-2022-27234EPSS 0.5%

    Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access.

  17. 6.3CVE-2023-22936EPSS 0.4%

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response…

  18. 5.3CVE-2023-25162EPSS 0.8%

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request…

  19. 6.5CVE-2022-45085EPSS 0.6%

    Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01.

  20. 9.1CVE-2023-25557EPSS 0.7%

    DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the D…

  21. 9.8CVE-2023-0574EPSS 0.6%

    Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing…

  22. 4.3CVE-2023-23943EPSS 0.9%

    Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Ser…

  23. 8.8CVE-2022-47872EPSS 0.9%

    A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.

  24. 6.5CVE-2022-37033EPSS 0.9%

    In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 …

  25. 7.5CVE-2023-24623EPSS 0.7%

    Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

  26. 5.3CVE-2023-24622EPSS 0.6%

    isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.

  27. 5.3CVE-2022-4201EPSS 0.5%

    A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

  28. 4.3CVE-2022-4335EPSS 0.8%

    A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.

  29. 5.0CVE-2023-24060EPSS 0.5%

    Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Hav…

  30. 6.5CVE-2023-24495EPSS 0.9%

    A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services cove…

  31. 9.8CVE-2022-46998EPSS 1.1%

    An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).

  32. 9.8CVE-2023-23560EPSS 14%

    In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.

  33. 8.1CVE-2021-43449EPSS 1.2%

    ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.

  34. 6.5CVE-2021-37498EPSS 0.6%

    An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation…

  35. 4.4CVE-2023-20002EPSS 0.2%

    A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation …

  36. 8.8CVE-2022-45926EPSS 17%

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.

  37. 7.5CVE-2023-22493EPSS 0.8%

    RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the net…

  38. 7.8CVE-2022-3841EPSS 0.2%

    RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage…

  39. 7.5CVE-2022-25026EPSS 24%

    A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.

  40. 7.5CVE-2023-21761EPSS 1.6%

    Microsoft Exchange Server Information Disclosure Vulnerability

  41. 9.8CVE-2022-39039EPSS 1.1%

    aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s) request to launch Server-Side Request Forgery (SSRF) attack, to perform arbitr…

  42. 5.3CVE-2022-45027EPSS 0.6%

    perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address.

  43. 9.8CVE-2017-20157EPSS 0.7%

    A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version …

  44. 7.5CVE-2022-38212EPSS 0.8%

    Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URL…

  45. 7.5CVE-2022-38211EPSS 0.9%

    Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URL…

  46. 7.5CVE-2022-38203EPSS 0.8%

    Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URL…

  47. 6.1CVE-2022-23544ExploitEPSS 1.7%

    MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Si…

  48. 7.5CVE-2022-45429EPSS 0.6%

    Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.

  49. 9.8CVE-2022-4725EPSS 0.7%

    A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manip…

  50. 5.3CVE-2022-37313EPSS 0.7%

    OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.