CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-GH22-G6W4-M562
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.
{
"affected": [],
"aliases": [
"CVE-2024-11030"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:22Z",
"severity": "HIGH"
},
"details": "GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic\u0027s Gradio Web server\u0027s credentials to access unauthorized web resources.",
"id": "GHSA-gh22-g6w4-m562",
"modified": "2025-03-20T12:32:41Z",
"published": "2025-03-20T12:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11030"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/729d9928-c28a-40fd-8a86-bb4ca2984bba"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH58-477C-R78W
Vulnerability from github – Published: 2025-04-04 12:30 – Updated: 2025-07-30 21:31A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
{
"affected": [],
"aliases": [
"CVE-2025-2243"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T10:15:16Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code.\u00a0This issue affects GravityZone Console: before 6.41.2.1.",
"id": "GHSA-gh58-477c-r78w",
"modified": "2025-07-30T21:31:34Z",
"published": "2025-04-04T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2243"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/support/security-advisories/ssrf-in-gravityzone-console-via-dns-truncation-va-12634"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GH85-MQ87-R7V3
Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2024-01-09 21:16A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.29.0"
},
"package": {
"ecosystem": "Maven",
"name": "com.coravy.hudson.plugins.github:github"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000184"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T21:16:37Z",
"nvd_published_at": "2018-06-05T20:29:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.",
"id": "GHSA-gh85-mq87-r7v3",
"modified": "2024-01-09T21:16:37Z",
"published": "2022-05-14T03:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000184"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/github-plugin/commit/9a20b7d74ec1bfa8afe260571485dec286b454a2"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/github-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-06-04/#SECURITY-799"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins GitHub Plugin server-side request forgery vulnerability exists"
}
GHSA-GHJJ-5H83-XF6V
Vulnerability from github – Published: 2024-02-07 03:30 – Updated: 2025-09-29 18:33Suite CRM version 7.14.2 allows making arbitrary HTTP requests through
the vulnerable server. This is possible because the application is vulnerable
to SSRF.
{
"affected": [],
"aliases": [
"CVE-2023-6388"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-07T03:15:49Z",
"severity": "MODERATE"
},
"details": "Suite CRM version 7.14.2 allows making arbitrary HTTP requests through\n\nthe vulnerable server. This is possible because the application is vulnerable\n\nto SSRF.",
"id": "GHSA-ghjj-5h83-xf6v",
"modified": "2025-09-29T18:33:07Z",
"published": "2024-02-07T03:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6388"
},
{
"type": "WEB",
"url": "https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/leon"
},
{
"type": "WEB",
"url": "https://github.com/salesagility/SuiteCRM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHMV-W35W-VHJ5
Vulnerability from github – Published: 2022-05-18 00:00 – Updated: 2022-05-27 00:01A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
{
"affected": [],
"aliases": [
"CVE-2022-28616"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-17T21:15:00Z",
"severity": "CRITICAL"
},
"details": "A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.",
"id": "GHSA-ghmv-w35w-vhj5",
"modified": "2022-05-27T00:01:30Z",
"published": "2022-05-18T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28616"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04278en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHPW-CPH8-V3RM
Vulnerability from github – Published: 2024-12-18 18:30 – Updated: 2026-02-20 21:31Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function.
{
"affected": [],
"aliases": [
"CVE-2024-55089"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-18T18:15:07Z",
"severity": "CRITICAL"
},
"details": "Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function.",
"id": "GHSA-ghpw-cph8-v3rm",
"modified": "2026-02-20T21:31:15Z",
"published": "2024-12-18T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55089"
},
{
"type": "WEB",
"url": "https://github.com/rhymix/rhymix/commit/464985b1ef382cc8cf852e9b028a960aa58b40c3"
},
{
"type": "WEB",
"url": "https://rhymix.org/news/1909005"
},
{
"type": "WEB",
"url": "https://tasteful-stamp-da4.notion.site/CVE-2024-55089-15b1e0f227cb8064a563c697709b7530?pvs=73"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHRM-C5PX-RWM2
Vulnerability from github – Published: 2022-05-14 01:30 – Updated: 2022-05-14 01:30Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.
{
"affected": [],
"aliases": [
"CVE-2018-9920"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-24T13:29:00Z",
"severity": "MODERATE"
},
"details": "Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.",
"id": "GHSA-ghrm-c5px-rwm2",
"modified": "2022-05-14T01:30:31Z",
"published": "2022-05-14T01:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9920"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/542035/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHV4-RV7X-5RVV
Vulnerability from github – Published: 2026-01-27 21:31 – Updated: 2026-01-27 21:31The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if "Public API" is enabled in the plugin settings, and 'allow_url_fopen' is set to 'On' on the server.
{
"affected": [],
"aliases": [
"CVE-2026-0746"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T19:16:13Z",
"severity": "MODERATE"
},
"details": "The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the \u0027get_audio\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if \"Public API\" is enabled in the plugin settings, and \u0027allow_url_fopen\u0027 is set to \u0027On\u0027 on the server.",
"id": "GHSA-ghv4-rv7x-5rvv",
"modified": "2026-01-27T21:31:48Z",
"published": "2026-01-27T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0746"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.3.1/classes/engines/chatml.php#L946"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3447500/ai-engine/trunk/classes/engines/chatml.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbba866d-93dd-4ef5-9670-ab958f61f06e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHX8-6GXC-7Q56
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.
{
"affected": [],
"aliases": [
"CVE-2018-0398"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-18T23:29:00Z",
"severity": "CRITICAL"
},
"details": "Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.",
"id": "GHSA-ghx8-6gxc-7q56",
"modified": "2022-05-13T01:35:15Z",
"published": "2022-05-13T01:35:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0398"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-finesse"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104886"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GJ43-R55Q-5H6R
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12bookstack is vulnerable to Server-Side Request Forgery (SSRF)
{
"affected": [],
"aliases": [
"CVE-2021-3758"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-02T12:15:00Z",
"severity": "MODERATE"
},
"details": "bookstack is vulnerable to Server-Side Request Forgery (SSRF)",
"id": "GHSA-gj43-r55q-5h6r",
"modified": "2022-05-24T19:12:55Z",
"published": "2022-05-24T19:12:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3758"
},
{
"type": "WEB",
"url": "https://github.com/bookstackapp/bookstack/commit/bee5e2c7ca637d034c6985c0328cef0ce068778e"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a8d7fb24-9a69-42f3-990a-2db93b53f76b"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.