CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6060 vulnerabilities reference this CWE, most recent first.
GHSA-9RJ9-V7HH-CG8Q
Vulnerability from github – Published: 2024-02-28 15:30 – Updated: 2024-02-28 15:30Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.
{
"affected": [],
"aliases": [
"CVE-2024-1965"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T13:15:07Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery vulnerability in Haivision\u0027s Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.",
"id": "GHSA-9rj9-v7hh-cg8q",
"modified": "2024-02-28T15:30:56Z",
"published": "2024-02-28T15:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1965"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9RM4-CC6F-8PQ7
Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2022-12-01 00:30A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could cause server configuration data to be exposed when an attacker modifies a URL.
{
"affected": [],
"aliases": [
"CVE-2019-6837"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-17T20:15:00Z",
"severity": "CRITICAL"
},
"details": "A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could cause server configuration data to be exposed when an attacker modifies a URL.",
"id": "GHSA-9rm4-cc6f-8pq7",
"modified": "2022-12-01T00:30:42Z",
"published": "2022-05-24T16:56:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6837"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-253-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9RPM-RWWC-XW43
Vulnerability from github – Published: 2026-07-21 06:31 – Updated: 2026-09-22 18:33A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.
{
"affected": [],
"aliases": [
"CVE-2026-15927"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T06:16:28Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Red Hat Quay\u0027s repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.",
"id": "GHSA-9rpm-rwwc-xw43",
"modified": "2026-09-22T18:33:03Z",
"published": "2026-07-21T06:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15927"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50931"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:52968"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53520"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54395"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63307"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:69255"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:70267"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-15927"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9RXX-66Q3-QPFV
Vulnerability from github – Published: 2026-01-24 09:30 – Updated: 2026-01-24 09:30The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.
{
"affected": [],
"aliases": [
"CVE-2026-0807"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-24T08:16:07Z",
"severity": "HIGH"
},
"details": "The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the \u0027url\u0027 parameter in the \u0027template_proxy\u0027 function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the \u0027/template-proxy/\u0027 and \u0027/proxy-image/\u0027 endpoint.",
"id": "GHSA-9rxx-66q3-qpfv",
"modified": "2026-01-24T09:30:26Z",
"published": "2026-01-24T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3444616"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V5P-4VVQ-FQ48
Vulnerability from github – Published: 2025-08-28 15:30 – Updated: 2026-04-01 18:36Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2.
{
"affected": [],
"aliases": [
"CVE-2025-48364"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-28T13:15:58Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2.",
"id": "GHSA-9v5p-4vvq-fq48",
"modified": "2026-04-01T18:36:00Z",
"published": "2025-08-28T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48364"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/rajce/vulnerability/wordpress-rajce-plugin-0-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V65-W6J3-V2W8
Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-01 15:30Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
{
"affected": [],
"aliases": [
"CVE-2026-67311"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-01T13:17:01Z",
"severity": "HIGH"
},
"details": "Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.",
"id": "GHSA-9v65-w6j3-v2w8",
"modified": "2026-08-01T15:30:27Z",
"published": "2026-08-01T15:30:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-86f3-cqpq-wp9m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67311"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/budibase-before-ssrf-blacklist-bypass-via-http-redirect"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9V9G-4GHW-XRXX
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-26815"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-10T17:15:00Z",
"severity": "HIGH"
},
"details": "SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.",
"id": "GHSA-9v9g-4ghw-xrxx",
"modified": "2022-05-24T17:34:00Z",
"published": "2022-05-24T17:34:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26815"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2984627"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9VP3-7QWQ-83R9
Vulnerability from github – Published: 2022-03-17 00:00 – Updated: 2022-03-25 13:33A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@frangoteam/fuxa"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-45851"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-25T13:33:46Z",
"nvd_published_at": "2022-03-16T10:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server\u0027s internal environment and services, often potentially leading to the attacker executing commands on the server.",
"id": "GHSA-9vp3-7qwq-83r9",
"modified": "2022-03-25T13:33:46Z",
"published": "2022-03-17T00:00:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45851"
},
{
"type": "PACKAGE",
"url": "https://github.com/frangoteam/FUXA"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=JE1Kcq3iJpc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in FUXA"
}
GHSA-9VWF-FV6W-MMFR
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.
{
"affected": [],
"aliases": [
"CVE-2026-92569"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:19:02Z",
"severity": "MODERATE"
},
"details": "Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.",
"id": "GHSA-9vwf-fv6w-mmfr",
"modified": "2026-09-16T15:31:14Z",
"published": "2026-09-16T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92569"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/issues/1621"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9VWR-WW7H-QVV8
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2022-10-10 19:00WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
{
"affected": [],
"aliases": [
"CVE-2019-17670"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-17T13:15:00Z",
"severity": "HIGH"
},
"details": "WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.",
"id": "GHSA-9vwr-ww7h-qvv8",
"modified": "2022-10-10T19:00:18Z",
"published": "2022-05-24T16:59:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17670"
},
{
"type": "WEB",
"url": "https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2"
},
{
"type": "WEB",
"url": "https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html"
},
{
"type": "WEB",
"url": "https://core.trac.wordpress.org/changeset/46472"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00010.html"
},
{
"type": "WEB",
"url": "https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.