cve.bz

CWE-918: Server-Side Request Forgery (SSRF), page 77

Filter

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

What the weakness is: CWE-918 at MITRE

Ask an AI about CWE-918

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-918: Server-Side Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/918.html and https://cve.bz/cve/cwe/918?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2019-20474EPSS 1.4%

    An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One…

  2. 9.8CVE-2020-8128EPSS 2.7%

    An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.

  3. 5.3CVE-2019-4741EPSS 1.0%

    IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other att…

  4. 5.0CVE-2020-8118EPSS 1.3%

    An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

  5. 7.5CVE-2020-3938EPSS 1.5%

    SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.

  6. 9.8CVE-2013-4864ExploitEPSS 6.3%

    MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery (SSRF) issue.

  7. 9.8CVE-2019-5464EPSS 2.8%

    A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

  8. 7.5CVE-2007-6758EPSS 1.3%

    Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.

  9. 7.5CVE-2019-19835EPSS 1.8%

    SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.

  10. 7.5CVE-2020-1925EPSS 2.8%

    Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks …

  11. 8.8CVE-2019-19261EPSS 1.0%

    GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.

  12. 7.2CVE-2018-20499EPSS 0.7%

    An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

  13. 5.0CVE-2018-20497EPSS 0.7%

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

  14. 6.5CVE-2019-20055EPSS 0.9%

    LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets.

  15. 7.2CVE-2019-19999EPSS 1.5%

    Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.

  16. 7.3CVE-2019-18379EPSS 1.1%

    Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attacker send crafted requests from the backend server of a vulnerable web applicatio…

  17. 9.8CVE-2019-16948EPSS 1.3%

    An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the interna…

  18. 7.2CVE-2019-8156EPSS 1.7%

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api e…

  19. 7.2CVE-2019-8151EPSS 1.7%

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-sid…

  20. 9.8CVE-2019-18394ExploitEPSS 32%

    A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

  21. 9.8CVE-2019-18355EPSS 1.5%

    An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

  22. 7.5CVE-2019-17400EPSS 2.2%

    The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.

  23. 9.8CVE-2019-17670EPSS 4.5%

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.

  24. 9.8CVE-2019-17669EPSS 5.2%

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.

  25. 5.4CVE-2019-14225EPSS 0.7%

    OX App Suite 7.10.1 and 7.10.2 allows SSRF.

  26. 7.5CVE-2017-18638ExploitEPSS 15%

    send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to thi…

  27. 5.3CVE-2019-15021EPSS 1.0%

    A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easily identify instances of Zingbox Inspectors in a local area network.

  28. 5.3CVE-2019-15164EPSS 2.9%

    rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.

  29. 9.8CVE-2019-13335EPSS 1.3%

    SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF.

  30. 10.0CVE-2019-16932ExploitEPSS 39%

    A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.

  31. 5.3CVE-2019-4262EPSS 1.0%

    IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the QRadar system, potentially leading to network enumeration or facilitating ot…

  32. 7.7CVE-2019-15033EPSS 1.3%

    Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F1…

  33. 9.1CVE-2019-6837EPSS 1.0%

    A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion …

  34. 5.3CVE-2019-15731EPSS 1.2%

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.

  35. 7.5CVE-2019-15730EPSS 1.5%

    An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which woul…

  36. 7.5CVE-2019-15728EPSS 1.5%

    An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network reso…

  37. 6.5CVE-2019-8451ExploitEPSS 94%

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the Jir…

  38. 5.3CVE-2019-12996EPSS 0.8%

    In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe.

  39. 7.0CVE-2019-6793ExploitEPSS 3.5%

    An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.

  40. 7.5CVE-2019-12633EPSS 1.5%

    A vulnerability in Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. The vulnerability…

  41. 7.5CVE-2019-12632EPSS 1.6%

    A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on an affected system. The vulnerability exists because the affected system …

  42. 10.0CVE-2019-13020EPSS 1.1%

    The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the brows…

  43. 9.8CVE-2019-15494EPSS 1.5%

    openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.

  44. 10.0CVE-2016-10927EPSS 1.6%

    The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

  45. 10.0CVE-2016-10926EPSS 1.6%

    The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

  46. 8.6CVE-2019-11897EPSS 1.8%

    A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. …

  47. 9.8CVE-2019-0345EPSS 2.3%

    A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application serv…

  48. 9.1CVE-2019-12994EPSS 4.4%

    Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.

  49. 8.8CVE-2019-12959EPSS 3.1%

    Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.

  50. 9.8CVE-2019-14255EPSS 2.2%

    A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to internal endpoints.