CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4710 vulnerabilities reference this CWE, most recent first.
GHSA-J989-FGGP-QGP5
Vulnerability from github – Published: 2026-05-13 21:32 – Updated: 2026-06-30 18:31The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
{
"affected": [],
"aliases": [
"CVE-2026-8328"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-13T21:16:50Z",
"severity": "MODERATE"
},
"details": "The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to\u00a0CVE-2021-4189.",
"id": "GHSA-j989-fggp-qgp5",
"modified": "2026-06-30T18:31:32Z",
"published": "2026-05-13T21:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8328"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/87451"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/149648"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J9CH-J53G-49HJ
Vulnerability from github – Published: 2024-01-10 09:30 – Updated: 2024-01-17 15:30Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2023-49471"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-10T09:15:44Z",
"severity": "HIGH"
},
"details": "Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.",
"id": "GHSA-j9ch-j53g-49hj",
"modified": "2024-01-17T15:30:26Z",
"published": "2024-01-10T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49471"
},
{
"type": "WEB",
"url": "https://github.com/zunak/CVE-2023-49471"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J9FQ-VWQV-2FM2
Vulnerability from github – Published: 2022-09-15 00:00 – Updated: 2023-06-21 18:10Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2900"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-15T16:17:41Z",
"nvd_published_at": "2022-09-14T11:15:00Z",
"severity": "CRITICAL"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.",
"id": "GHSA-j9fq-vwqv-2fm2",
"modified": "2023-06-21T18:10:04Z",
"published": "2022-09-15T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2900"
},
{
"type": "WEB",
"url": "https://github.com/ionicabizau/parse-url/commit/b88c81df8f4c5168af454eaa4f92afa9349e4e13"
},
{
"type": "PACKAGE",
"url": "https://github.com/IonicaBizau/parse-url"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url"
}
GHSA-J9GJ-58QX-H9VW
Vulnerability from github – Published: 2023-05-31 15:30 – Updated: 2023-05-31 15:30A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
{
"affected": [],
"aliases": [
"CVE-2023-3015"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T14:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.",
"id": "GHSA-j9gj-58qx-h9vw",
"modified": "2023-05-31T15:30:20Z",
"published": "2023-05-31T15:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3015"
},
{
"type": "WEB",
"url": "https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/VIP-video-analysis/SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230359"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J9MG-7MRV-2WWC
Vulnerability from github – Published: 2026-07-02 15:32 – Updated: 2026-07-02 15:32A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
{
"affected": [],
"aliases": [
"CVE-2026-54401"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T15:17:03Z",
"severity": "HIGH"
},
"details": "A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.",
"id": "GHSA-j9mg-7mrv-2wwc",
"modified": "2026-07-02T15:32:12Z",
"published": "2026-07-02T15:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54401"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9PJ-HX76-92V6
Vulnerability from github – Published: 2021-05-10 18:38 – Updated: 2021-04-21 20:55This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "phantomjs-seo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7739"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-21T20:55:27Z",
"nvd_published_at": "2020-10-06T15:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.",
"id": "GHSA-j9pj-hx76-92v6",
"modified": "2021-04-21T20:55:27Z",
"published": "2021-05-10T18:38:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7739"
},
{
"type": "WEB",
"url": "https://github.com/areverberi/phantomjs-seo/blob/083f66892f97d67031668decb917389ffc32a94c/index.js%23L17"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PHANTOMJSSEO-609638"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/phantomjs-seo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in phantomjs-seo"
}
GHSA-J9X3-MX4X-WH8R
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2026-06-22 21:30MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
{
"affected": [],
"aliases": [
"CVE-2020-28043"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-02T21:15:00Z",
"severity": "HIGH"
},
"details": "MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.",
"id": "GHSA-j9x3-mx4x-wh8r",
"modified": "2026-06-22T21:30:42Z",
"published": "2022-05-24T17:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28043"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JC25-R723-4CF5
Vulnerability from github – Published: 2023-06-13 09:30 – Updated: 2024-04-04 04:45A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.
{
"affected": [],
"aliases": [
"CVE-2023-25609"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-13T09:15:16Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability\u00a0[CWE-918] in\u00a0FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.",
"id": "GHSA-jc25-r723-4cf5",
"modified": "2024-04-04T04:45:30Z",
"published": "2023-06-13T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25609"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-22-493"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JC3M-32W2-FFJC
Vulnerability from github – Published: 2025-08-14 12:30 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward allows Server Side Request Forgery. This issue affects PressForward: from n/a through 5.9.1.
{
"affected": [],
"aliases": [
"CVE-2025-28987"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T11:15:31Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward allows Server Side Request Forgery. This issue affects PressForward: from n/a through 5.9.1.",
"id": "GHSA-jc3m-32w2-ffjc",
"modified": "2026-04-01T18:35:48Z",
"published": "2025-08-14T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28987"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/pressforward/vulnerability/wordpress-pressforward-5-8-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JCPJ-R94H-977W
Vulnerability from github – Published: 2026-04-27 21:31 – Updated: 2026-04-27 21:31A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-7147"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-27T19:16:53Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-jcpj-r94h-977w",
"modified": "2026-04-27T21:31:03Z",
"published": "2026-04-27T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7147"
},
{
"type": "WEB",
"url": "https://github.com/JoeCastrom/mcp-chat-studio/issues/4"
},
{
"type": "WEB",
"url": "https://github.com/JoeCastrom/mcp-chat-studio"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/801896"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359746"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359746/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.