CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4849 vulnerabilities reference this CWE, most recent first.
GHSA-3GWQ-RJ9C-4F42
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 03:31SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-42965"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T01:15:23Z",
"severity": "MODERATE"
},
"details": "SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.",
"id": "GHSA-3gwq-rj9c-4f42",
"modified": "2025-07-08T03:31:00Z",
"published": "2025-07-08T03:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42965"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3598118"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H26-Q9XC-FJFF
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:53ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
{
"affected": [],
"aliases": [
"CVE-2019-9187"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-05T18:29:00Z",
"severity": "HIGH"
},
"details": "ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.",
"id": "GHSA-3h26-q9xc-fjff",
"modified": "2024-04-04T00:53:12Z",
"published": "2022-05-24T16:47:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9187"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news/version_3.20190228"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HH3-HX7R-GGC2
Vulnerability from github – Published: 2026-04-09 15:35 – Updated: 2026-04-14 18:30Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
{
"affected": [],
"aliases": [
"CVE-2025-50228"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-09T15:16:07Z",
"severity": "CRITICAL"
},
"details": "Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.",
"id": "GHSA-3hh3-hx7r-ggc2",
"modified": "2026-04-14T18:30:31Z",
"published": "2026-04-09T15:35:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50228"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms/issues/104"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms"
},
{
"type": "WEB",
"url": "https://www.jizhicms.cn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HR5-6MX7-874C
Vulnerability from github – Published: 2025-04-27 00:30 – Updated: 2025-04-28 12:30A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3954"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-26T22:15:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3hr5-6mx7-874c",
"modified": "2025-04-28T12:30:24Z",
"published": "2025-04-27T00:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3954"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/p/2c56b9ec-5747-40a3-b089-ff796f23ebd4"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/ssrf-via-referrer-field-in-churchcrm-v5-16-0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555938"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3HVP-8GH4-HRX5
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
{
"affected": [],
"aliases": [
"CVE-2020-25353"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-20T19:15:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.",
"id": "GHSA-3hvp-8gh4-hrx5",
"modified": "2022-05-24T19:11:48Z",
"published": "2022-05-24T19:11:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25353"
},
{
"type": "WEB",
"url": "https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3J6C-RQ24-CP7J
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-13 21:30Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through <= 1.4.0.
{
"affected": [],
"aliases": [
"CVE-2026-39695"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:41Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in podigee Podigee podigee allows Server Side Request Forgery.This issue affects Podigee: from n/a through \u003c= 1.4.0.",
"id": "GHSA-3j6c-rq24-cp7j",
"modified": "2026-04-13T21:30:36Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39695"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/podigee/vulnerability/wordpress-podigee-plugin-1-4-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3J96-4R54-MHQG
Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2022-09-23 00:00The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
{
"affected": [],
"aliases": [
"CVE-2022-30579"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-20T19:15:00Z",
"severity": "HIGH"
},
"details": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.",
"id": "GHSA-3j96-4r54-mhqg",
"modified": "2022-09-23T00:00:42Z",
"published": "2022-09-21T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30579"
},
{
"type": "WEB",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"type": "WEB",
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3J9J-5462-CPX8
Vulnerability from github – Published: 2023-10-22 18:30 – Updated: 2025-11-04 18:30link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
{
"affected": [],
"aliases": [
"CVE-2023-46303"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-22T18:15:08Z",
"severity": "HIGH"
},
"details": "link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.",
"id": "GHSA-3j9j-5462-cpx8",
"modified": "2025-11-04T18:30:44Z",
"published": "2023-10-22T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46303"
},
{
"type": "WEB",
"url": "https://github.com/0x1717/ssrf-via-img"
},
{
"type": "WEB",
"url": "https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3JCW-PH85-3MV4
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.
{
"affected": [],
"aliases": [
"CVE-2020-24700"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T08:15:00Z",
"severity": "MODERATE"
},
"details": "OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.",
"id": "GHSA-3jcw-ph85-3mv4",
"modified": "2022-05-24T17:38:30Z",
"published": "2022-05-24T17:38:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24700"
},
{
"type": "WEB",
"url": "https://www.open-xchange.com"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Jul/33"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3JHJ-3M5P-2G94
Vulnerability from github – Published: 2025-10-22 15:31 – Updated: 2026-01-20 15:31Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61.
{
"affected": [],
"aliases": [
"CVE-2025-49374"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T15:15:35Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through \u003c= 1.0.61.",
"id": "GHSA-3jhj-3m5p-2g94",
"modified": "2026-01-20T15:31:22Z",
"published": "2025-10-22T15:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49374"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.