cve.bz

CWE-918: Server-Side Request Forgery (SSRF), page 76

Filter

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

What the weakness is: CWE-918 at MITRE

Ask an AI about CWE-918

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-918: Server-Side Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/918.html and https://cve.bz/cve/cwe/918?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2020-13295EPSS 1.2%

    For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.

  2. 5.8CVE-2020-16248ExploitEPSS 3.1%

    Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability

  3. 7.5CVE-2020-15823EPSS 2.0%

    JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.

  4. 5.3CVE-2020-15819EPSS 1.4%

    JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

  5. 8.8CVE-2020-13970EPSS 1.3%

    Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform serve…

  6. 7.5CVE-2020-15879EPSS 2.7%

    Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).

  7. 7.5CVE-2020-8205EPSS 1.2%

    The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

  8. 4.3CVE-2020-13788EPSS 1.3%

    Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.

  9. 5.8CVE-2020-6282EPSS 1.1%

    SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send a cr…

  10. 4.3CVE-2020-14170EPSS 0.8%

    Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability.

  11. 9.8CVE-2020-14056EPSS 1.3%

    Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party …

  12. 5.3CVE-2019-20408EPSS 1.0%

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the Jir…

  13. 9.8CVE-2020-13484EPSS 2.0%

    Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing '<meta name="og:image" content="' followed by an…

  14. 5.5CVE-2019-20872EPSS 0.3%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

  15. 6.5CVE-2020-8544EPSS 1.1%

    OX App Suite through 7.10.3 allows SSRF.

  16. 7.5CVE-2020-13650EPSS 1.0%

    An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that allows use of the application as a proxy. Sent to an external server, a forged …

  17. 5.0CVE-2020-9427EPSS 1.1%

    OX Guard 2.10.3 and earlier allows SSRF.

  18. 6.3CVE-2020-11980EPSS 1.9%

    In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has…

  19. 7.5CVE-2020-9645EPSS 3.4%

    Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

  20. 7.5CVE-2020-9643EPSS 3.4%

    Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

  21. 7.2CVE-2020-12725EPSS 1.3%

    Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility i…

  22. 9.8CVE-2020-4101EPSS 1.1%

    "HCL Digital Experience is susceptible to Server Side Request Forgery."

  23. 9.8CVE-2020-6275EPSS 1.5%

    SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names …

  24. 7.4CVE-2020-4529EPSS 0.8%

    IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilita…

  25. 6.3CVE-2020-8555EPSS 3.7%

    The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 b…

  26. 8.2CVE-2020-13379ExploitEPSS 99.8%

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.…

  27. 8.8CVE-2014-8943EPSS 1.0%

    Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

  28. 9.8CVE-2020-13226EPSS 2.1%

    WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.

  29. 4.3CVE-2020-4365EPSS 1.4%

    IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.

  30. 8.8CVE-2020-8830EPSS 0.5%

    CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.

  31. 4.9CVE-2020-5562EPSS 0.9%

    Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function.

  32. 7.2CVE-2020-11885EPSS 0.8%

    WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.

  33. 6.3CVE-2020-4294EPSS 1.2%

    IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other…

  34. 9.8CVE-2020-10980EPSS 1.9%

    GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.

  35. 5.3CVE-2020-11453EPSS 2.7%

    Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parame…

  36. 4.3CVE-2020-11452EPSS 1.2%

    Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resourc…

  37. 9.8CVE-2020-10956EPSS 1.4%

    GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

  38. 7.5CVE-2020-3769EPSS 2.9%

    Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

  39. 6.5CVE-2020-10791EPSS 1.2%

    app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) …

  40. 9.8CVE-2019-11574EPSS 1.5%

    An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.

  41. 6.5CVE-2020-8138EPSS 1.4%

    A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

  42. 9.8CVE-2020-8135EPSS 1.3%

    The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.

  43. 8.1CVE-2020-8134EPSS 1.2%

    Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.

  44. 9.8CVE-2020-10077EPSS 1.2%

    GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.

  45. 9.8CVE-2020-8540EPSS 13%

    An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted D…

  46. 7.5CVE-2019-13121EPSS 0.9%

    An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access…

  47. 9.8CVE-2019-12443EPSS 1.2%

    An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.

  48. 9.8CVE-2020-10212EPSS 1.5%

    upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF…

  49. 5.0CVE-2019-18846EPSS 0.9%

    OX App Suite through 7.10.2 allows SSRF.

  50. 9.8CVE-2020-7796KEVExploitEPSS 94%

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.