CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4757 vulnerabilities reference this CWE, most recent first.
GHSA-9FV7-HP8V-PJRP
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark allows Server Side Request Forgery. This issue affects SocialMark: from n/a through 2.0.7.
{
"affected": [],
"aliases": [
"CVE-2025-29008"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:30Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark allows Server Side Request Forgery. This issue affects SocialMark: from n/a through 2.0.7.",
"id": "GHSA-9fv7-hp8v-pjrp",
"modified": "2026-04-01T18:35:18Z",
"published": "2025-06-06T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29008"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/socialmark/vulnerability/wordpress-socialmark-2-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9FXJ-MCHQ-843P
Vulnerability from github – Published: 2026-07-13 00:31 – Updated: 2026-07-13 00:31A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted_path_and_query can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-15508"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-12T23:16:36Z",
"severity": "LOW"
},
"details": "A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted_path_and_query can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-9fxj-mchq-843p",
"modified": "2026-07-13T00:31:41Z",
"published": "2026-07-13T00:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15508"
},
{
"type": "WEB",
"url": "https://github.com/oscar2744/CVE-Submit/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-15508"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/845671"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377837"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377837/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9G2J-5685-H44H
Vulnerability from github – Published: 2022-05-17 04:03 – Updated: 2023-08-04 23:08Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.ambari:ambari"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-1775"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-04T23:08:30Z",
"nvd_published_at": "2015-11-02T19:59:00Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (SSRF) vulnerability in the proxy endpoint (`api/v1/proxy`) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.",
"id": "GHSA-9g2j-5685-h44h",
"modified": "2023-08-04T23:08:30Z",
"published": "2022-05-17T04:03:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1775"
},
{
"type": "WEB",
"url": "https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.1.0"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/10/13/2"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Ambari SSRF Vulnerability"
}
GHSA-9G2Q-6JW7-CQFM
Vulnerability from github – Published: 2024-02-28 09:30 – Updated: 2024-02-28 09:30The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2024-1568"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T07:15:08Z",
"severity": "MODERATE"
},
"details": "The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-9g2q-6jw7-cqfm",
"modified": "2024-02-28T09:30:35Z",
"published": "2024-02-28T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1568"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3040707/seraphinite-accelerator"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07287a85-df00-408a-8b02-978fd3116155?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9G62-4VWM-573R
Vulnerability from github – Published: 2026-01-06 06:31 – Updated: 2026-01-06 06:31The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-14438"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-06T05:15:58Z",
"severity": "MODERATE"
},
"details": "The Xagio SEO \u2013 AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the \u0027pixabayDownloadImage\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-9g62-4vwm-573r",
"modified": "2026-01-06T06:31:28Z",
"published": "2026-01-06T06:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14438"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/inc/xagio_core.php#L236"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L135"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L91"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3426300/xagio-seo#file374"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72779dd2-04eb-445d-88a0-28a9c4d2369b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GQC-C5M8-VF5Q
Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01Affected versions of Confluence Server before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.
{
"affected": [],
"aliases": [
"CVE-2020-29445"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-07T06:15:00Z",
"severity": "MODERATE"
},
"details": "Affected versions of Confluence Server before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.",
"id": "GHSA-9gqc-c5m8-vf5q",
"modified": "2022-05-24T19:01:50Z",
"published": "2022-05-24T19:01:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29445"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CONFSERVER-61453"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GR7-GH74-QG9X
Vulnerability from github – Published: 2024-07-17 09:30 – Updated: 2025-01-21 18:27Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.streampipes:streampipes-parent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.95.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "streampipes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.95.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-31979"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-18T20:19:47Z",
"nvd_published_at": "2024-07-17T09:15:02Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.\nPreviously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. \nThese endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.\n\nThis issue affects Apache StreamPipes: through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.",
"id": "GHSA-9gr7-gh74-qg9x",
"modified": "2025-01-21T18:27:30Z",
"published": "2024-07-17T09:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31979"
},
{
"type": "WEB",
"url": "https://github.com/apache/streampipes/commit/cd5a7b46e3383573f0f2b51da4b7306d4936aa3f"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/streampipes"
},
{
"type": "WEB",
"url": "https://github.com/apache/streampipes/releases/tag/release%2F0.95.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/streampipes/PYSEC-2024-174.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0y"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/16/11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache StreamPipes has possibility of SSRF in pipeline element installation process"
}
GHSA-9H3Q-32C7-R533
Vulnerability from github – Published: 2025-07-23 06:33 – Updated: 2025-09-25 21:49All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "private-ip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-8020"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-23T16:01:49Z",
"nvd_published_at": "2025-07-23T05:15:30Z",
"severity": "HIGH"
},
"details": "All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package\u0027s source code.",
"id": "GHSA-9h3q-32c7-r533",
"modified": "2025-09-25T21:49:54Z",
"published": "2025-07-23T06:33:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8020"
},
{
"type": "WEB",
"url": "https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1"
},
{
"type": "PACKAGE",
"url": "https://github.com/frenchbread/private-ip"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "private-ip vulnerable to Server-Side Request Forgery"
}
GHSA-9HCX-GVX4-R4RP
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-12 00:00An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.
{
"affected": [],
"aliases": [
"CVE-2022-1188"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.",
"id": "GHSA-9hcx-gvx4-r4rp",
"modified": "2022-04-12T00:00:49Z",
"published": "2022-04-05T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1188"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1486659"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1188.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/354059"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9HP9-487W-FFQM
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2025-05-30 18:30Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
{
"affected": [],
"aliases": [
"CVE-2021-31531"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-29T14:15:00Z",
"severity": "CRITICAL"
},
"details": "Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).",
"id": "GHSA-9hp9-487w-ffqm",
"modified": "2025-05-30T18:30:40Z",
"published": "2022-05-24T19:06:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31531"
},
{
"type": "WEB",
"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31531"
},
{
"type": "WEB",
"url": "https://excellium-services.com/cert-xlm-advisory/cve-2021-31531"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/service-desk-msp/readme.html#10521"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.