CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4787 vulnerabilities reference this CWE, most recent first.
GHSA-7JJG-GM2C-94V7
Vulnerability from github – Published: 2024-12-26 06:30 – Updated: 2024-12-30 18:30The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
{
"affected": [],
"aliases": [
"CVE-2024-10903"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-26T06:15:05Z",
"severity": "MODERATE"
},
"details": "The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.",
"id": "GHSA-7jjg-gm2c-94v7",
"modified": "2024-12-30T18:30:41Z",
"published": "2024-12-26T06:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10903"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/39027390-ce01-4dd5-a979-426785aa7acb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7JM8-4VMP-FF6G
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-6308"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-20T14:15:00Z",
"severity": "MODERATE"
},
"details": "SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.",
"id": "GHSA-7jm8-4vmp-ff6g",
"modified": "2022-05-24T17:31:52Z",
"published": "2022-05-24T17:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6308"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2943844"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7JVH-4MQP-GF66
Vulnerability from github – Published: 2024-09-23 18:30 – Updated: 2024-09-25 03:30An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.
{
"affected": [],
"aliases": [
"CVE-2024-40441"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-23T17:15:13Z",
"severity": "MODERATE"
},
"details": "An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.",
"id": "GHSA-7jvh-4mqp-gf66",
"modified": "2024-09-25T03:30:35Z",
"published": "2024-09-23T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40441"
},
{
"type": "WEB",
"url": "https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23"
},
{
"type": "WEB",
"url": "https://github.com/doccano/doccano/releases/tag/v1.8.4"
},
{
"type": "WEB",
"url": "https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JVR-HF5M-XMJJ
Vulnerability from github – Published: 2022-04-26 00:00 – Updated: 2022-05-06 00:01Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
{
"affected": [],
"aliases": [
"CVE-2022-27429"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-25T13:15:00Z",
"severity": "CRITICAL"
},
"details": "Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.",
"id": "GHSA-7jvr-hf5m-xmjj",
"modified": "2022-05-06T00:01:20Z",
"published": "2022-04-26T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27429"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms/issues/67"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7M2P-62GW-P8QQ
Vulnerability from github – Published: 2026-06-09 06:31 – Updated: 2026-06-09 06:31Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
{
"affected": [],
"aliases": [
"CVE-2026-41854"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T05:16:37Z",
"severity": "MODERATE"
},
"details": "Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.",
"id": "GHSA-7m2p-62gw-p8qq",
"modified": "2026-06-09T06:31:58Z",
"published": "2026-06-09T06:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41854"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-41854"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7M34-7CHV-8X87
Vulnerability from github – Published: 2026-06-30 21:31 – Updated: 2026-06-30 21:31IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
{
"affected": [],
"aliases": [
"CVE-2026-11546"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T20:17:27Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.",
"id": "GHSA-7m34-7chv-8x87",
"modified": "2026-06-30T21:31:44Z",
"published": "2026-06-30T21:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11546"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7278572"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7M4R-MVJ2-XJPX
Vulnerability from github – Published: 2024-05-03 18:30 – Updated: 2024-07-03 18:38TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php).
{
"affected": [],
"aliases": [
"CVE-2024-34453"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T18:15:10Z",
"severity": "MODERATE"
},
"details": "TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api\u0026method=read_data\u0026type=connectivity_test (which reaches /system/api.php).",
"id": "GHSA-7m4r-mvj2-xjpx",
"modified": "2024-07-03T18:38:50Z",
"published": "2024-05-03T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34453"
},
{
"type": "WEB",
"url": "https://github.com/tznb1/TwoNav/issues/9#issuecomment-2022194939"
},
{
"type": "WEB",
"url": "https://github.com/tznb1/TwoNav/compare/v2.1.13-20240321...v2.1.14-20240419"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7M83-4F94-8QQR
Vulnerability from github – Published: 2024-10-25 21:31 – Updated: 2024-10-30 21:30An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.
{
"affected": [],
"aliases": [
"CVE-2024-48232"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T21:15:04Z",
"severity": "MODERATE"
},
"details": "An issue was found in mipjz 5.0.5. In the mipPost method of \\app\\setting\\controller\\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.",
"id": "GHSA-7m83-4f94-8qqr",
"modified": "2024-10-30T21:30:38Z",
"published": "2024-10-25T21:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48232"
},
{
"type": "WEB",
"url": "https://github.com/sansanyun/mipjz/issues/17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7M9C-P64G-7PCW
Vulnerability from github – Published: 2025-07-07 06:30 – Updated: 2025-07-07 06:30Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers.
{
"affected": [],
"aliases": [
"CVE-2025-53473"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-07T05:15:42Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers.",
"id": "GHSA-7m9c-p64g-7pcw",
"modified": "2025-07-07T06:30:24Z",
"published": "2025-07-07T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53473"
},
{
"type": "WEB",
"url": "https://aws.amazon.com/marketplace/seller-profile?id=08fb48d1-5d60-4feb-93c6-c0c219278a2c"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN88251376"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7MH9-PM6V-7VQQ
Vulnerability from github – Published: 2022-05-17 02:59 – Updated: 2022-05-17 02:59IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources.
{
"affected": [],
"aliases": [
"CVE-2016-6001"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-01T22:59:00Z",
"severity": "LOW"
},
"details": "IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources.",
"id": "GHSA-7mh9-pm6v-7vqq",
"modified": "2022-05-17T02:59:58Z",
"published": "2022-05-17T02:59:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6001"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21991280"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.