CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6598 vulnerabilities reference this CWE, most recent first.
GHSA-J963-VC5V-49CP
Vulnerability from github – Published: 2022-05-14 01:32 – Updated: 2022-05-14 01:32An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
{
"affected": [],
"aliases": [
"CVE-2018-15657"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-05T03:29:00Z",
"severity": "HIGH"
},
"details": "An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx \"url\" parameter.",
"id": "GHSA-j963-vc5v-49cp",
"modified": "2022-05-14T01:32:46Z",
"published": "2022-05-14T01:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15657"
},
{
"type": "WEB",
"url": "https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46305"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J989-FGGP-QGP5
Vulnerability from github – Published: 2026-05-13 21:32 – Updated: 2026-06-30 18:31The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
{
"affected": [],
"aliases": [
"CVE-2026-8328"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-13T21:16:50Z",
"severity": "MODERATE"
},
"details": "The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to\u00a0CVE-2021-4189.",
"id": "GHSA-j989-fggp-qgp5",
"modified": "2026-06-30T18:31:32Z",
"published": "2026-05-13T21:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8328"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/87451"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/149648"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/2bbcf3fb7a420a05605576c0f9468d4675381b5f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ef12d0dc824baccf737bba1458e5eed3d1e0fceb"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J99H-P584-X29H
Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31{
"affected": [],
"aliases": [
"CVE-2026-81265"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T22:17:02Z",
"severity": "HIGH"
},
"details": "IBM Langflow OSS 1.0.0 through 1.11.5.",
"id": "GHSA-j99h-p584-x29h",
"modified": "2026-09-11T00:31:15Z",
"published": "2026-09-11T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81265"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7286665"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9CH-J53G-49HJ
Vulnerability from github – Published: 2024-01-10 09:30 – Updated: 2024-01-17 15:30Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2023-49471"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-10T09:15:44Z",
"severity": "HIGH"
},
"details": "Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.",
"id": "GHSA-j9ch-j53g-49hj",
"modified": "2024-01-17T15:30:26Z",
"published": "2024-01-10T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49471"
},
{
"type": "WEB",
"url": "https://github.com/zunak/CVE-2023-49471"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J9FQ-VWQV-2FM2
Vulnerability from github – Published: 2022-09-15 00:00 – Updated: 2023-06-21 18:10Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2900"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-15T16:17:41Z",
"nvd_published_at": "2022-09-14T11:15:00Z",
"severity": "CRITICAL"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.",
"id": "GHSA-j9fq-vwqv-2fm2",
"modified": "2023-06-21T18:10:04Z",
"published": "2022-09-15T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2900"
},
{
"type": "WEB",
"url": "https://github.com/ionicabizau/parse-url/commit/b88c81df8f4c5168af454eaa4f92afa9349e4e13"
},
{
"type": "PACKAGE",
"url": "https://github.com/IonicaBizau/parse-url"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url"
}
GHSA-J9GJ-58QX-H9VW
Vulnerability from github – Published: 2023-05-31 15:30 – Updated: 2023-05-31 15:30A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
{
"affected": [],
"aliases": [
"CVE-2023-3015"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T14:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.",
"id": "GHSA-j9gj-58qx-h9vw",
"modified": "2023-05-31T15:30:20Z",
"published": "2023-05-31T15:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3015"
},
{
"type": "WEB",
"url": "https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/VIP-video-analysis/SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230359"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J9MG-7MRV-2WWC
Vulnerability from github – Published: 2026-07-02 15:32 – Updated: 2026-07-02 15:32A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
{
"affected": [],
"aliases": [
"CVE-2026-54401"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T15:17:03Z",
"severity": "HIGH"
},
"details": "A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.",
"id": "GHSA-j9mg-7mrv-2wwc",
"modified": "2026-07-02T15:32:12Z",
"published": "2026-07-02T15:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54401"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9PJ-HX76-92V6
Vulnerability from github – Published: 2021-05-10 18:38 – Updated: 2021-04-21 20:55This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "phantomjs-seo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7739"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-21T20:55:27Z",
"nvd_published_at": "2020-10-06T15:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.",
"id": "GHSA-j9pj-hx76-92v6",
"modified": "2021-04-21T20:55:27Z",
"published": "2021-05-10T18:38:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7739"
},
{
"type": "WEB",
"url": "https://github.com/areverberi/phantomjs-seo/blob/083f66892f97d67031668decb917389ffc32a94c/index.js%23L17"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PHANTOMJSSEO-609638"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/phantomjs-seo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in phantomjs-seo"
}
GHSA-J9WC-MRP3-532H
Vulnerability from github – Published: 2026-08-24 18:31 – Updated: 2026-08-24 18:31Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and backend/config/webhook-server.php sets no Guzzle options, so redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Both event and organizer webhooks share the rule and the dispatch path. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.
{
"affected": [],
"aliases": [
"CVE-2026-76838"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T18:17:22Z",
"severity": "HIGH"
},
"details": "Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and backend/config/webhook-server.php sets no Guzzle options, so redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname\u0027s DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Both event and organizer webhooks share the rule and the dispatch path. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.",
"id": "GHSA-j9wc-mrp3-532h",
"modified": "2026-08-24T18:31:58Z",
"published": "2026-08-24T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76838"
},
{
"type": "WEB",
"url": "https://github.com/HiEventsDev/Hi.Events/pull/1311"
},
{
"type": "WEB",
"url": "https://github.com/HiEventsDev/Hi.Events/commit/cfbf468bb5b1"
},
{
"type": "WEB",
"url": "https://github.com/HiEventsDev/Hi.Events"
},
{
"type": "WEB",
"url": "https://github.com/HiEventsDev/Hi.Events/blob/v.1.11.0-beta/backend/app/Validators/Rules/NoInternalUrlRule.php"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hi-events-before-beta-server-side-request-forgery-via-unvalidated-webhook-redirects"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J9X3-MX4X-WH8R
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2026-06-22 21:30MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
{
"affected": [],
"aliases": [
"CVE-2020-28043"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-02T21:15:00Z",
"severity": "HIGH"
},
"details": "MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.",
"id": "GHSA-j9x3-mx4x-wh8r",
"modified": "2026-06-22T21:30:42Z",
"published": "2022-05-24T17:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28043"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.