Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4747 vulnerabilities reference this CWE, most recent first.
GHSA-GHJJ-5H83-XF6V
Vulnerability from github – Published: 2024-02-07 03:30 – Updated: 2025-09-29 18:33
VLAI
Details
Suite CRM version 7.14.2 allows making arbitrary HTTP requests through
the vulnerable server. This is possible because the application is vulnerable
to SSRF.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-6388"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-07T03:15:49Z",
"severity": "MODERATE"
},
"details": "Suite CRM version 7.14.2 allows making arbitrary HTTP requests through\n\nthe vulnerable server. This is possible because the application is vulnerable\n\nto SSRF.",
"id": "GHSA-ghjj-5h83-xf6v",
"modified": "2025-09-29T18:33:07Z",
"published": "2024-02-07T03:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6388"
},
{
"type": "WEB",
"url": "https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/leon"
},
{
"type": "WEB",
"url": "https://github.com/salesagility/SuiteCRM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHMV-W35W-VHJ5
Vulnerability from github – Published: 2022-05-18 00:00 – Updated: 2022-05-27 00:01
VLAI
Details
A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-28616"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-17T21:15:00Z",
"severity": "CRITICAL"
},
"details": "A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.",
"id": "GHSA-ghmv-w35w-vhj5",
"modified": "2022-05-27T00:01:30Z",
"published": "2022-05-18T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28616"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04278en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHPW-CPH8-V3RM
Vulnerability from github – Published: 2024-12-18 18:30 – Updated: 2026-02-20 21:31
VLAI
Details
Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-55089"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-18T18:15:07Z",
"severity": "CRITICAL"
},
"details": "Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function.",
"id": "GHSA-ghpw-cph8-v3rm",
"modified": "2026-02-20T21:31:15Z",
"published": "2024-12-18T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55089"
},
{
"type": "WEB",
"url": "https://github.com/rhymix/rhymix/commit/464985b1ef382cc8cf852e9b028a960aa58b40c3"
},
{
"type": "WEB",
"url": "https://rhymix.org/news/1909005"
},
{
"type": "WEB",
"url": "https://tasteful-stamp-da4.notion.site/CVE-2024-55089-15b1e0f227cb8064a563c697709b7530?pvs=73"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHRM-C5PX-RWM2
Vulnerability from github – Published: 2022-05-14 01:30 – Updated: 2022-05-14 01:30
VLAI
Details
Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-9920"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-24T13:29:00Z",
"severity": "MODERATE"
},
"details": "Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.",
"id": "GHSA-ghrm-c5px-rwm2",
"modified": "2022-05-14T01:30:31Z",
"published": "2022-05-14T01:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9920"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/542035/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHV4-RV7X-5RVV
Vulnerability from github – Published: 2026-01-27 21:31 – Updated: 2026-01-27 21:31
VLAI
Details
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if "Public API" is enabled in the plugin settings, and 'allow_url_fopen' is set to 'On' on the server.
Severity
6.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-0746"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T19:16:13Z",
"severity": "MODERATE"
},
"details": "The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the \u0027get_audio\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if \"Public API\" is enabled in the plugin settings, and \u0027allow_url_fopen\u0027 is set to \u0027On\u0027 on the server.",
"id": "GHSA-ghv4-rv7x-5rvv",
"modified": "2026-01-27T21:31:48Z",
"published": "2026-01-27T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0746"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.3.1/classes/engines/chatml.php#L946"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3447500/ai-engine/trunk/classes/engines/chatml.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbba866d-93dd-4ef5-9670-ab958f61f06e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHX8-6GXC-7Q56
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35
VLAI
Details
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-0398"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-18T23:29:00Z",
"severity": "CRITICAL"
},
"details": "Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.",
"id": "GHSA-ghx8-6gxc-7q56",
"modified": "2022-05-13T01:35:15Z",
"published": "2022-05-13T01:35:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0398"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-finesse"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104886"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GJ43-R55Q-5H6R
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12
VLAI
Details
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
{
"affected": [],
"aliases": [
"CVE-2021-3758"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-02T12:15:00Z",
"severity": "MODERATE"
},
"details": "bookstack is vulnerable to Server-Side Request Forgery (SSRF)",
"id": "GHSA-gj43-r55q-5h6r",
"modified": "2022-05-24T19:12:55Z",
"published": "2022-05-24T19:12:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3758"
},
{
"type": "WEB",
"url": "https://github.com/bookstackapp/bookstack/commit/bee5e2c7ca637d034c6985c0328cef0ce068778e"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a8d7fb24-9a69-42f3-990a-2db93b53f76b"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GJ7G-7F7F-WJR5
Vulnerability from github – Published: 2025-04-16 18:31 – Updated: 2025-04-16 18:31
VLAI
Details
Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.
This issue affects Apache HertzBeat (incubating): before 1.7.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-56736"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T16:15:28Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.\n\nThis issue affects Apache HertzBeat (incubating): before 1.7.0.\n\nUsers are recommended to upgrade to version 1.7.0, which fixes the issue.",
"id": "GHSA-gj7g-7f7f-wjr5",
"modified": "2025-04-16T18:31:49Z",
"published": "2025-04-16T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56736"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/kdzg36h9yxp0q0n4lhcfppxntjy8rj1x"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/lwfhsllos1rx9v8k0yhl252cbpqpn0sv"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/16/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJWQ-9V8P-47W7
Vulnerability from github – Published: 2026-05-22 00:31 – Updated: 2026-06-24 21:02
VLAI
Summary
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
Details
In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-7890"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-24T21:02:33Z",
"nvd_published_at": "2026-05-21T22:16:49Z",
"severity": "LOW"
},
"details": "In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation\u00a0enabling redirect-to-internal bypasses.",
"id": "GHSA-gjwq-9v8p-47w7",
"modified": "2026-06-24T21:02:33Z",
"published": "2026-05-22T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7890"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"
},
{
"type": "PACKAGE",
"url": "https://github.com/concretecms/concretecms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Concrete CMS\u0027s RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation"
}
GHSA-GJXX-92W9-8V8F
Vulnerability from github – Published: 2026-03-27 19:58 – Updated: 2026-04-06 16:44
VLAI
Summary
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Details
Summary
The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server.
Affected packages
Only applications that have opted into the frontendApiProxy feature are affected. This feature is not enabled by default. Users of @clerk/nextjs are not affected due to how the framework handles repeated / in request paths.
| Package | Affected versions | Fixed version |
|---|---|---|
@clerk/backend |
>= 3.0.0, <= 3.2.2 |
3.2.3 |
@clerk/express |
>= 2.0.0, <= 2.0.6 |
2.0.7 |
@clerk/hono |
>= 0.1.0, <= 0.1.4 |
0.1.5 |
@clerk/fastify |
>= 3.1.0, <= 3.1.4 |
3.1.5 |
Search your codebase for the frontendApiProxy option. If none of the patterns below appear in your code, you are not affected.
@clerk/express
app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));
@clerk/hono
app.use('*', clerkMiddleware({ frontendApiProxy: { enabled: true } }));
@clerk/fastify
fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });
@clerk/backend
import { clerkFrontendApiProxy } from '@clerk/backend/proxy';
A quick way to check across your entire project:
grep -r "frontendApiProxy\|clerkFrontendApiProxy" .
If there are no matches, you are not using this feature.
Recommended actions
Clerk's internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.
- Upgrade to the patched version of
@clerk/backend(and@clerk/express,@clerk/hono, etc.) - Rotate your Clerk Secret Key after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the Clerk Dashboard under API Keys. You should deploy your application with the updated key before revoking the existing key.
- Audit access logs for requests to your proxy endpoint (
/__clerk/by default) containing double slashes in the path.
Credit
Discovered during an internal code audit.
Severity
7.4 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.2"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/backend"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.6"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/express"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.4"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/hono"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "0.1.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.4"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/fastify"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34076"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T19:58:19Z",
"nvd_published_at": "2026-04-01T18:16:29Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `clerkFrontendApiProxy` function in `@clerk/backend` is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application\u0027s `Clerk-Secret-Key` to an attacker-controlled server.\n\n## Affected packages\n\nOnly applications that have opted into the `frontendApiProxy` feature are affected. This feature is not enabled by default. **Users of `@clerk/nextjs` are not affected** due to how the framework handles repeated `/` in request paths.\n\n| Package | Affected versions | Fixed version |\n|---|---|---|\n| `@clerk/backend` | `\u003e= 3.0.0, \u003c= 3.2.2` | `3.2.3` |\n| `@clerk/express` | `\u003e= 2.0.0, \u003c= 2.0.6` | `2.0.7` |\n| `@clerk/hono` | `\u003e= 0.1.0, \u003c= 0.1.4` | `0.1.5` |\n| `@clerk/fastify` | `\u003e= 3.1.0, \u003c= 3.1.4` | `3.1.5` |\n\nSearch your codebase for the `frontendApiProxy` option. If none of the patterns below appear in your code, you are not affected.\n\n**@clerk/express**\n```ts\napp.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));\n```\n\n**@clerk/hono**\n```ts\napp.use(\u0027*\u0027, clerkMiddleware({ frontendApiProxy: { enabled: true } }));\n```\n\n**@clerk/fastify**\n```ts\nfastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });\n```\n\n**@clerk/backend**\n```ts\nimport { clerkFrontendApiProxy } from \u0027@clerk/backend/proxy\u0027;\n```\n\nA quick way to check across your entire project:\n\n```sh\ngrep -r \"frontendApiProxy\\|clerkFrontendApiProxy\" .\n```\n\nIf there are no matches, you are not using this feature.\n\n\n## Recommended actions\n\nClerk\u0027s internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.\n\n1. **Upgrade** to the patched version of `@clerk/backend` (and `@clerk/express`, `@clerk/hono`, etc.)\n2. **Rotate your Clerk Secret Key** after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the [Clerk Dashboard](https://dashboard.clerk.com) under **API Keys**. You should deploy your application with the updated key before revoking the existing key.\n3. **Audit access logs** for requests to your proxy endpoint (`/__clerk/` by default) containing double slashes in the path.\n\n\n\n## Credit\n\nDiscovered during an internal code audit.",
"id": "GHSA-gjxx-92w9-8v8f",
"modified": "2026-04-06T16:44:03Z",
"published": "2026-03-27T19:58:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34076"
},
{
"type": "PACKAGE",
"url": "https://github.com/clerk/javascript"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.