CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-GJ7G-7F7F-WJR5
Vulnerability from github – Published: 2025-04-16 18:31 – Updated: 2025-04-16 18:31Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.
This issue affects Apache HertzBeat (incubating): before 1.7.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2024-56736"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T16:15:28Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.\n\nThis issue affects Apache HertzBeat (incubating): before 1.7.0.\n\nUsers are recommended to upgrade to version 1.7.0, which fixes the issue.",
"id": "GHSA-gj7g-7f7f-wjr5",
"modified": "2025-04-16T18:31:49Z",
"published": "2025-04-16T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56736"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/kdzg36h9yxp0q0n4lhcfppxntjy8rj1x"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/lwfhsllos1rx9v8k0yhl252cbpqpn0sv"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/16/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJWQ-9V8P-47W7
Vulnerability from github – Published: 2026-05-22 00:31 – Updated: 2026-06-24 21:02In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-7890"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-24T21:02:33Z",
"nvd_published_at": "2026-05-21T22:16:49Z",
"severity": "LOW"
},
"details": "In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation\u00a0enabling redirect-to-internal bypasses.",
"id": "GHSA-gjwq-9v8p-47w7",
"modified": "2026-06-24T21:02:33Z",
"published": "2026-05-22T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7890"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"
},
{
"type": "PACKAGE",
"url": "https://github.com/concretecms/concretecms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Concrete CMS\u0027s RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation"
}
GHSA-GJXX-92W9-8V8F
Vulnerability from github – Published: 2026-03-27 19:58 – Updated: 2026-04-06 16:44Summary
The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server.
Affected packages
Only applications that have opted into the frontendApiProxy feature are affected. This feature is not enabled by default. Users of @clerk/nextjs are not affected due to how the framework handles repeated / in request paths.
| Package | Affected versions | Fixed version |
|---|---|---|
@clerk/backend |
>= 3.0.0, <= 3.2.2 |
3.2.3 |
@clerk/express |
>= 2.0.0, <= 2.0.6 |
2.0.7 |
@clerk/hono |
>= 0.1.0, <= 0.1.4 |
0.1.5 |
@clerk/fastify |
>= 3.1.0, <= 3.1.4 |
3.1.5 |
Search your codebase for the frontendApiProxy option. If none of the patterns below appear in your code, you are not affected.
@clerk/express
app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));
@clerk/hono
app.use('*', clerkMiddleware({ frontendApiProxy: { enabled: true } }));
@clerk/fastify
fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });
@clerk/backend
import { clerkFrontendApiProxy } from '@clerk/backend/proxy';
A quick way to check across your entire project:
grep -r "frontendApiProxy\|clerkFrontendApiProxy" .
If there are no matches, you are not using this feature.
Recommended actions
Clerk's internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.
- Upgrade to the patched version of
@clerk/backend(and@clerk/express,@clerk/hono, etc.) - Rotate your Clerk Secret Key after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the Clerk Dashboard under API Keys. You should deploy your application with the updated key before revoking the existing key.
- Audit access logs for requests to your proxy endpoint (
/__clerk/by default) containing double slashes in the path.
Credit
Discovered during an internal code audit.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.2"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/backend"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.6"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/express"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.4"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/hono"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "0.1.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.4"
},
"package": {
"ecosystem": "npm",
"name": "@clerk/fastify"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34076"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T19:58:19Z",
"nvd_published_at": "2026-04-01T18:16:29Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `clerkFrontendApiProxy` function in `@clerk/backend` is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application\u0027s `Clerk-Secret-Key` to an attacker-controlled server.\n\n## Affected packages\n\nOnly applications that have opted into the `frontendApiProxy` feature are affected. This feature is not enabled by default. **Users of `@clerk/nextjs` are not affected** due to how the framework handles repeated `/` in request paths.\n\n| Package | Affected versions | Fixed version |\n|---|---|---|\n| `@clerk/backend` | `\u003e= 3.0.0, \u003c= 3.2.2` | `3.2.3` |\n| `@clerk/express` | `\u003e= 2.0.0, \u003c= 2.0.6` | `2.0.7` |\n| `@clerk/hono` | `\u003e= 0.1.0, \u003c= 0.1.4` | `0.1.5` |\n| `@clerk/fastify` | `\u003e= 3.1.0, \u003c= 3.1.4` | `3.1.5` |\n\nSearch your codebase for the `frontendApiProxy` option. If none of the patterns below appear in your code, you are not affected.\n\n**@clerk/express**\n```ts\napp.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));\n```\n\n**@clerk/hono**\n```ts\napp.use(\u0027*\u0027, clerkMiddleware({ frontendApiProxy: { enabled: true } }));\n```\n\n**@clerk/fastify**\n```ts\nfastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });\n```\n\n**@clerk/backend**\n```ts\nimport { clerkFrontendApiProxy } from \u0027@clerk/backend/proxy\u0027;\n```\n\nA quick way to check across your entire project:\n\n```sh\ngrep -r \"frontendApiProxy\\|clerkFrontendApiProxy\" .\n```\n\nIf there are no matches, you are not using this feature.\n\n\n## Recommended actions\n\nClerk\u0027s internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.\n\n1. **Upgrade** to the patched version of `@clerk/backend` (and `@clerk/express`, `@clerk/hono`, etc.)\n2. **Rotate your Clerk Secret Key** after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the [Clerk Dashboard](https://dashboard.clerk.com) under **API Keys**. You should deploy your application with the updated key before revoking the existing key.\n3. **Audit access logs** for requests to your proxy endpoint (`/__clerk/` by default) containing double slashes in the path.\n\n\n\n## Credit\n\nDiscovered during an internal code audit.",
"id": "GHSA-gjxx-92w9-8v8f",
"modified": "2026-04-06T16:44:03Z",
"published": "2026-03-27T19:58:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34076"
},
{
"type": "PACKAGE",
"url": "https://github.com/clerk/javascript"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host"
}
GHSA-GM3J-WM5R-799C
Vulnerability from github – Published: 2022-01-29 00:00 – Updated: 2022-03-19 00:01A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
{
"affected": [],
"aliases": [
"CVE-2022-22993"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-28T20:15:00Z",
"severity": "HIGH"
},
"details": "A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.",
"id": "GHSA-gm3j-wm5r-799c",
"modified": "2022-03-19T00:01:47Z",
"published": "2022-01-29T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22993"
},
{
"type": "WEB",
"url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-348"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GM42-W748-RGWW
Vulnerability from github – Published: 2025-08-15 09:31 – Updated: 2025-08-15 09:31The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-8013"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-15T07:15:28Z",
"severity": "LOW"
},
"details": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the \u0027RunExternalScan\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-gm42-w748-rgww",
"modified": "2025-08-15T09:31:14Z",
"published": "2025-08-15T09:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8013"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3344330"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GM45-8HGV-XG5F
Vulnerability from github – Published: 2023-12-26 12:31 – Updated: 2024-01-04 03:30Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also without authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2023-50968"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-26T12:15:07Z",
"severity": "HIGH"
},
"details": "Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.\n\nThe same uri can be operated to realize a SSRF attack also without authorizations.\n\nUsers are recommended to upgrade to version 18.12.11, which fixes this issue.",
"id": "GHSA-gm45-8hgv-xg5f",
"modified": "2024-01-04T03:30:38Z",
"published": "2023-12-26T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50968"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/OFBIZ-12875"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/download.html"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/release-notes-18.12.11.html"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/security.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/26/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GM48-83X4-84JG
Vulnerability from github – Published: 2022-06-10 00:00 – Updated: 2022-06-17 19:20bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dubbo:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.7.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.alibaba:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24969"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-10T19:53:04Z",
"nvd_published_at": "2022-06-09T16:15:00Z",
"severity": "MODERATE"
},
"details": "bypass CVE-2021-25640 \u003e In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.",
"id": "GHSA-gm48-83x4-84jg",
"modified": "2022-06-17T19:20:46Z",
"published": "2022-06-10T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25640"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24969"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gw4j-4229-q4px"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-side request forgery in Apache Dubbo"
}
GHSA-GM4Q-XM9R-RFRP
Vulnerability from github – Published: 2025-03-31 15:30 – Updated: 2026-04-01 18:34Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1.
{
"affected": [],
"aliases": [
"CVE-2025-31527"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T13:15:46Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1.",
"id": "GHSA-gm4q-xm9r-rfrp",
"modified": "2026-04-01T18:34:15Z",
"published": "2025-03-31T15:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31527"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-link-preview/vulnerability/wordpress-wp-link-preview-plugin-1-4-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GMHJ-76HP-7WH3
Vulnerability from github – Published: 2025-05-15 21:31 – Updated: 2025-05-17 06:30The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
{
"affected": [],
"aliases": [
"CVE-2024-6584"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:55Z",
"severity": "CRITICAL"
},
"details": "The \u0027wp_ajax_boost_proxy_ig\u0027 action allows administrators to make GET requests to arbitrary URLs.",
"id": "GHSA-gmhj-76hp-7wh3",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6584"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GMP6-HG9Q-F8GW
Vulnerability from github – Published: 2024-07-08 03:32 – Updated: 2024-07-08 03:32IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.
{
"affected": [],
"aliases": [
"CVE-2024-31897"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-08T03:15:02Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.",
"id": "GHSA-gmp6-hg9q-f8gw",
"modified": "2024-07-08T03:32:13Z",
"published": "2024-07-08T03:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31897"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7159332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.