CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4757 vulnerabilities reference this CWE, most recent first.
GHSA-CRH9-3GJH-M6GC
Vulnerability from github – Published: 2026-04-09 03:31 – Updated: 2026-04-10 19:19A weakness has been identified in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_test_scenarios/test_http_endpoint of the file src/mcp/http-server.ts of the component HTTP Interface. This manipulation of the argument source/url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "api-lab-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-5832"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-10T19:19:34Z",
"nvd_published_at": "2026-04-09T02:16:18Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_test_scenarios/test_http_endpoint of the file src/mcp/http-server.ts of the component HTTP Interface. This manipulation of the argument source/url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-crh9-3gjh-m6gc",
"modified": "2026-04-10T19:19:34Z",
"published": "2026-04-09T03:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5832"
},
{
"type": "WEB",
"url": "https://github.com/BruceJqs/public_exp/issues/6"
},
{
"type": "WEB",
"url": "https://github.com/atototo/api-lab-mcp/issues/4"
},
{
"type": "PACKAGE",
"url": "https://github.com/atototo/api-lab-mcp"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/789765"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/356288"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/356288/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "api-lab-mcp vulnerable to SSRF"
}
GHSA-CRR9-3X94-M79R
Vulnerability from github – Published: 2022-10-25 19:00 – Updated: 2022-10-26 19:00Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2022-27622"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.",
"id": "GHSA-crr9-3x94-m79r",
"modified": "2022-10-26T19:00:39Z",
"published": "2022-10-25T19:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27622"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_22_18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CRX8-WPV6-JRJ2
Vulnerability from github – Published: 2026-04-20 06:31 – Updated: 2026-04-28 23:20A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6606"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-28T23:20:51Z",
"nvd_published_at": "2026-04-20T05:16:15Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-crx8-wpv6-jrj2",
"modified": "2026-04-28T23:20:51Z",
"published": "2026-04-20T06:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6606"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/4e589eec07446726612dc416a7d80820"
},
{
"type": "PACKAGE",
"url": "https://github.com/agentscope-ai/agentscope"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/792226"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358241"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358241/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "AgentScope vulnerable to Server-Side Request Forgery"
}
GHSA-CV25-4WMR-RXPJ
Vulnerability from github – Published: 2023-03-07 18:30 – Updated: 2023-03-14 21:30loonflow r2.0.14 is vulnerable to server-side request forgery (SSRF).
{
"affected": [],
"aliases": [
"CVE-2023-25230"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "loonflow r2.0.14 is vulnerable to server-side request forgery (SSRF).",
"id": "GHSA-cv25-4wmr-rxpj",
"modified": "2023-03-14T21:30:22Z",
"published": "2023-03-07T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25230"
},
{
"type": "WEB",
"url": "https://github.com/blackholll/loonflow/issues/402"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CV6P-WXC8-W6PC
Vulnerability from github – Published: 2022-10-14 12:00 – Updated: 2022-10-14 12:00iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
{
"affected": [],
"aliases": [
"CVE-2022-41496"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-13T21:15:00Z",
"severity": "CRITICAL"
},
"details": "iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.",
"id": "GHSA-cv6p-wxc8-w6pc",
"modified": "2022-10-14T12:00:17Z",
"published": "2022-10-14T12:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41496"
},
{
"type": "WEB",
"url": "https://github.com/jayus0821/insight/blob/master/iCMS%20SSRF.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CV96-5348-P5P8
Vulnerability from github – Published: 2026-06-12 18:27 – Updated: 2026-06-12 18:27Summary
The VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with builder-level access can supply an arbitrary host value such as 169.254.169.254 or localhost, causing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints on their behalf.
Details
The validator responsible for VectorDB creation and updates defines the host field as Joi.string().required(), which enforces only that the value is a non-empty string. No allowlist of external hostnames, no blocklist of RFC 1918 or link-local ranges, and no scheme validation are applied before the value is forwarded to the database SDK for connection establishment.
When a VectorDB entry is created or updated, the SDK uses the supplied host directly to open a TCP connection. Because the connection attempt originates from the Budibase server process, it traverses internal network boundaries that would otherwise be inaccessible to the attacker. Differences in connection timing and error messages between reachable and unreachable hosts allow an attacker to enumerate internal services and determine whether specific addresses are live. In cloud environments, the AWS EC2 metadata service at 169.254.169.254, the GCP metadata server at metadata.google.internal, and equivalent endpoints for other providers are all reachable this way.
Builder access is a realistic precondition in multi-tenant or team deployments, as the builder role is intended to allow application development without granting administrative privileges over the underlying infrastructure.
PoC
import requests
import time
BASE_URL = "https://TARGET_BUDIBASE_INSTANCE"
SESSION = requests.Session()
login_resp = SESSION.post(f"{BASE_URL}/api/global/auth/default/login", json={
"username": "builder@example.com",
"password": "builderpassword"
})
token = login_resp.cookies.get("budibase:auth") or login_resp.json().get("token")
SESSION.headers.update({"Cookie": f"budibase:auth={token}"})
targets = [
("169.254.169.254", 80),
("localhost", 5432),
("10.0.0.1", 22),
]
for host, port in targets:
start = time.time()
resp = SESSION.post(f"{BASE_URL}/api/ai/vectordb", json={
"name": f"probe_{host.replace('.', '_')}_{port}",
"provider": "pgvector",
"host": host,
"port": port,
"database": "db"
})
elapsed = time.time() - start
print(f"host={host} port={port} status={resp.status_code} time={elapsed:.2f}s body={resp.text[:200]}")
Impact
An attacker with builder access can use the Budibase server as a proxy to probe internal network topology, determine which hosts and ports are reachable from the server, and potentially interact with unauthenticated internal services including cloud instance metadata endpoints. In environments where cloud metadata endpoints expose credentials or instance identity documents, successful retrieval of metadata could lead to privilege escalation or lateral movement within the cloud environment. The attack requires no interaction beyond a single authenticated API request per probe target.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@budibase/server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.35.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48148"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T18:27:45Z",
"nvd_published_at": "2026-05-27T18:16:27Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with builder-level access can supply an arbitrary host value such as `169.254.169.254` or localhost, causing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints on their behalf.\n\n### Details\n\nThe validator responsible for VectorDB creation and updates defines the host field as `Joi.string().required()`, which enforces only that the value is a non-empty string. No allowlist of external hostnames, no blocklist of RFC 1918 or link-local ranges, and no scheme validation are applied before the value is forwarded to the database SDK for connection establishment.\n\nWhen a VectorDB entry is created or updated, the SDK uses the supplied host directly to open a TCP connection. Because the connection attempt originates from the Budibase server process, it traverses internal network boundaries that would otherwise be inaccessible to the attacker. Differences in connection timing and error messages between reachable and unreachable hosts allow an attacker to enumerate internal services and determine whether specific addresses are live. In cloud environments, the AWS EC2 metadata service at `169.254.169.254`, the GCP metadata server at `metadata.google.internal`, and equivalent endpoints for other providers are all reachable this way.\n\nBuilder access is a realistic precondition in multi-tenant or team deployments, as the builder role is intended to allow application development without granting administrative privileges over the underlying infrastructure.\n\n### PoC\n\n```python\nimport requests\nimport time\n\nBASE_URL = \"https://TARGET_BUDIBASE_INSTANCE\"\nSESSION = requests.Session()\n\nlogin_resp = SESSION.post(f\"{BASE_URL}/api/global/auth/default/login\", json={\n \"username\": \"builder@example.com\",\n \"password\": \"builderpassword\"\n})\ntoken = login_resp.cookies.get(\"budibase:auth\") or login_resp.json().get(\"token\")\nSESSION.headers.update({\"Cookie\": f\"budibase:auth={token}\"})\n\ntargets = [\n (\"169.254.169.254\", 80),\n (\"localhost\", 5432),\n (\"10.0.0.1\", 22),\n]\n\nfor host, port in targets:\n start = time.time()\n resp = SESSION.post(f\"{BASE_URL}/api/ai/vectordb\", json={\n \"name\": f\"probe_{host.replace(\u0027.\u0027, \u0027_\u0027)}_{port}\",\n \"provider\": \"pgvector\",\n \"host\": host,\n \"port\": port,\n \"database\": \"db\"\n })\n elapsed = time.time() - start\n print(f\"host={host} port={port} status={resp.status_code} time={elapsed:.2f}s body={resp.text[:200]}\")\n```\n\n### Impact\n\nAn attacker with builder access can use the Budibase server as a proxy to probe internal network topology, determine which hosts and ports are reachable from the server, and potentially interact with unauthenticated internal services including cloud instance metadata endpoints. In environments where cloud metadata endpoints expose credentials or instance identity documents, successful retrieval of metadata could lead to privilege escalation or lateral movement within the cloud environment. The attack requires no interaction beyond a single authenticated API request per probe target.",
"id": "GHSA-cv96-5348-p5p8",
"modified": "2026-06-12T18:27:45Z",
"published": "2026-06-12T18:27:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-cv96-5348-p5p8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48148"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Budibase: Unvalidated VectorDB Host Parameter Enables SSRF"
}
GHSA-CVFR-4CV2-RXVJ
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040.
{
"affected": [],
"aliases": [
"CVE-2018-0403"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-18T23:29:00Z",
"severity": "CRITICAL"
},
"details": "Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040.",
"id": "GHSA-cvfr-4cv2-rxvj",
"modified": "2022-05-13T01:35:14Z",
"published": "2022-05-13T01:35:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0403"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041352"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CVPQ-JX4G-WHH2
Vulnerability from github – Published: 2022-05-14 03:22 – Updated: 2022-05-14 03:22SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter.
{
"affected": [],
"aliases": [
"CVE-2017-14323"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-10T15:29:00Z",
"severity": "CRITICAL"
},
"details": "SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter.",
"id": "GHSA-cvpq-jx4g-whh2",
"modified": "2022-05-14T03:22:59Z",
"published": "2022-05-14T03:22:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14323"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Apr/16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CVVX-WCX7-G65M
Vulnerability from github – Published: 2026-07-13 03:31 – Updated: 2026-07-13 03:31A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performing a manipulation of the argument final_url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.10.0 is able to resolve this issue. The patch is named 217399723e3a2fb39389e5355d49ed80aaf9ea7c. Upgrading the affected component is advised.
{
"affected": [],
"aliases": [
"CVE-2026-15525"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T03:16:16Z",
"severity": "LOW"
},
"details": "A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performing a manipulation of the argument final_url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.10.0 is able to resolve this issue. The patch is named 217399723e3a2fb39389e5355d49ed80aaf9ea7c. Upgrading the affected component is advised.",
"id": "GHSA-cvvx-wcx7-g65m",
"modified": "2026-07-13T03:31:48Z",
"published": "2026-07-13T03:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15525"
},
{
"type": "WEB",
"url": "https://github.com/kLOsk/adloop/issues/41"
},
{
"type": "WEB",
"url": "https://github.com/kLOsk/adloop/commit/217399723e3a2fb39389e5355d49ed80aaf9ea7c"
},
{
"type": "WEB",
"url": "https://github.com/kLOsk/adloop"
},
{
"type": "WEB",
"url": "https://github.com/kLOsk/adloop/releases/tag/v0.10.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-15525"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/854528"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377854"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377854/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CVX4-254W-9PPG
Vulnerability from github – Published: 2022-07-14 00:00 – Updated: 2022-07-21 00:00The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
{
"affected": [],
"aliases": [
"CVE-2022-22982"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-13T19:15:00Z",
"severity": "HIGH"
},
"details": "The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.",
"id": "GHSA-cvx4-254w-9ppg",
"modified": "2022-07-21T00:00:31Z",
"published": "2022-07-14T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22982"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2022-0018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.