CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4747 vulnerabilities reference this CWE, most recent first.
GHSA-GM3J-WM5R-799C
Vulnerability from github – Published: 2022-01-29 00:00 – Updated: 2022-03-19 00:01A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
{
"affected": [],
"aliases": [
"CVE-2022-22993"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-28T20:15:00Z",
"severity": "HIGH"
},
"details": "A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.",
"id": "GHSA-gm3j-wm5r-799c",
"modified": "2022-03-19T00:01:47Z",
"published": "2022-01-29T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22993"
},
{
"type": "WEB",
"url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-348"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GM42-W748-RGWW
Vulnerability from github – Published: 2025-08-15 09:31 – Updated: 2025-08-15 09:31The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-8013"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-15T07:15:28Z",
"severity": "LOW"
},
"details": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the \u0027RunExternalScan\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-gm42-w748-rgww",
"modified": "2025-08-15T09:31:14Z",
"published": "2025-08-15T09:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8013"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3344330"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GM45-8HGV-XG5F
Vulnerability from github – Published: 2023-12-26 12:31 – Updated: 2024-01-04 03:30Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also without authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2023-50968"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-26T12:15:07Z",
"severity": "HIGH"
},
"details": "Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.\n\nThe same uri can be operated to realize a SSRF attack also without authorizations.\n\nUsers are recommended to upgrade to version 18.12.11, which fixes this issue.",
"id": "GHSA-gm45-8hgv-xg5f",
"modified": "2024-01-04T03:30:38Z",
"published": "2023-12-26T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50968"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/OFBIZ-12875"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/download.html"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/release-notes-18.12.11.html"
},
{
"type": "WEB",
"url": "https://ofbiz.apache.org/security.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/26/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GM48-83X4-84JG
Vulnerability from github – Published: 2022-06-10 00:00 – Updated: 2022-06-17 19:20bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dubbo:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.7.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.alibaba:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24969"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-10T19:53:04Z",
"nvd_published_at": "2022-06-09T16:15:00Z",
"severity": "MODERATE"
},
"details": "bypass CVE-2021-25640 \u003e In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.",
"id": "GHSA-gm48-83x4-84jg",
"modified": "2022-06-17T19:20:46Z",
"published": "2022-06-10T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25640"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24969"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gw4j-4229-q4px"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-side request forgery in Apache Dubbo"
}
GHSA-GM4Q-XM9R-RFRP
Vulnerability from github – Published: 2025-03-31 15:30 – Updated: 2026-04-01 18:34Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1.
{
"affected": [],
"aliases": [
"CVE-2025-31527"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T13:15:46Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1.",
"id": "GHSA-gm4q-xm9r-rfrp",
"modified": "2026-04-01T18:34:15Z",
"published": "2025-03-31T15:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31527"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-link-preview/vulnerability/wordpress-wp-link-preview-plugin-1-4-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GMHJ-76HP-7WH3
Vulnerability from github – Published: 2025-05-15 21:31 – Updated: 2025-05-17 06:30The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
{
"affected": [],
"aliases": [
"CVE-2024-6584"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:55Z",
"severity": "CRITICAL"
},
"details": "The \u0027wp_ajax_boost_proxy_ig\u0027 action allows administrators to make GET requests to arbitrary URLs.",
"id": "GHSA-gmhj-76hp-7wh3",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6584"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GMP6-HG9Q-F8GW
Vulnerability from github – Published: 2024-07-08 03:32 – Updated: 2024-07-08 03:32IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.
{
"affected": [],
"aliases": [
"CVE-2024-31897"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-08T03:15:02Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 288178.",
"id": "GHSA-gmp6-hg9q-f8gw",
"modified": "2024-07-08T03:32:13Z",
"published": "2024-07-08T03:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31897"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288178"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7159332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GMWR-9J4P-96VM
Vulnerability from github – Published: 2026-04-16 00:54 – Updated: 2026-04-16 22:28ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "processwire/processwire"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.255"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40500"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T22:28:24Z",
"nvd_published_at": "2026-04-15T22:17:22Z",
"severity": "MODERATE"
},
"details": "ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel\u0027s \u0027Add Module From URL\u0027 feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.",
"id": "GHSA-gmwr-9j4p-96vm",
"modified": "2026-04-16T22:28:24Z",
"published": "2026-04-16T00:54:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40500"
},
{
"type": "WEB",
"url": "https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82"
},
{
"type": "PACKAGE",
"url": "https://github.com/processwire/processwire"
},
{
"type": "WEB",
"url": "https://processwire.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ProcessWire: server-side request forgery vulnerability in the admin panel\u0027s \u0027Add Module From URL\u0027 feature"
}
GHSA-GMXH-HJFV-QC2W
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-16 18:32An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL.
{
"affected": [],
"aliases": [
"CVE-2026-50888"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T20:16:31Z",
"severity": "HIGH"
},
"details": "An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL.",
"id": "GHSA-gmxh-hjfv-qc2w",
"modified": "2026-06-16T18:32:33Z",
"published": "2026-06-15T21:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50888"
},
{
"type": "WEB",
"url": "https://gist.github.com/pyuysig/d60273c1c346257ceddbf8da7134bae7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GP3H-JQ5W-CHRC
Vulnerability from github – Published: 2023-12-15 18:30 – Updated: 2026-04-28 21:33Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.
{
"affected": [],
"aliases": [
"CVE-2023-49159"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-15T16:15:43Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4.",
"id": "GHSA-gp3h-jq5w-chrc",
"modified": "2026-04-28T21:33:21Z",
"published": "2023-12-15T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49159"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/commentluv/wordpress-commentluv-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.