CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6064 vulnerabilities reference this CWE, most recent first.
GHSA-9VP3-7QWQ-83R9
Vulnerability from github – Published: 2022-03-17 00:00 – Updated: 2022-03-25 13:33A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@frangoteam/fuxa"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-45851"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-25T13:33:46Z",
"nvd_published_at": "2022-03-16T10:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server\u0027s internal environment and services, often potentially leading to the attacker executing commands on the server.",
"id": "GHSA-9vp3-7qwq-83r9",
"modified": "2022-03-25T13:33:46Z",
"published": "2022-03-17T00:00:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45851"
},
{
"type": "PACKAGE",
"url": "https://github.com/frangoteam/FUXA"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=JE1Kcq3iJpc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in FUXA"
}
GHSA-9VWF-FV6W-MMFR
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.
{
"affected": [],
"aliases": [
"CVE-2026-92569"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:19:02Z",
"severity": "MODERATE"
},
"details": "Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.",
"id": "GHSA-9vwf-fv6w-mmfr",
"modified": "2026-09-16T15:31:14Z",
"published": "2026-09-16T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92569"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/issues/1621"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107"
},
{
"type": "WEB",
"url": "https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9VWR-WW7H-QVV8
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2022-10-10 19:00WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
{
"affected": [],
"aliases": [
"CVE-2019-17670"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-17T13:15:00Z",
"severity": "HIGH"
},
"details": "WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.",
"id": "GHSA-9vwr-ww7h-qvv8",
"modified": "2022-10-10T19:00:18Z",
"published": "2022-05-24T16:59:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17670"
},
{
"type": "WEB",
"url": "https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2"
},
{
"type": "WEB",
"url": "https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html"
},
{
"type": "WEB",
"url": "https://core.trac.wordpress.org/changeset/46472"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00010.html"
},
{
"type": "WEB",
"url": "https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9W28-5VWJ-MQ45
Vulnerability from github – Published: 2026-09-26 15:31 – Updated: 2026-09-26 15:31Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.
{
"affected": [],
"aliases": [
"CVE-2026-100697"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-26T14:16:54Z",
"severity": "MODERATE"
},
"details": "Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing \u0027SELECT version()\u0027 to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.",
"id": "GHSA-9w28-5vwj-mq45",
"modified": "2026-09-26T15:31:21Z",
"published": "2026-09-26T15:31:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100697"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9W78-79Q7-R4FP
Vulnerability from github – Published: 2026-07-22 22:01 – Updated: 2026-07-22 22:01Impact
Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.
By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL, defeating the restriction meant to confine requests to the node's own upstream service. With SSRF protection disabled by default (N8N_SSRF_PROTECTION_ENABLED=false), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.
Patches
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Set N8N_SSRF_PROTECTION_ENABLED=true to enable SSRF filtering for private IP ranges and cloud metadata endpoints.
- Restrict network egress from the n8n host to limit reachable internal services.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.64"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.30.0"
},
{
"fixed": "2.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.29.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65593"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:01:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\n\nEndpoints in `/rest/dynamic-node-parameters/` lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required.\n\nBy supplying an absolute URL in the routing configuration, a caller could override the node type\u0027s declared baseURL, defeating the restriction meant to confine requests to the node\u0027s own upstream service. With SSRF protection disabled by default (`N8N_SSRF_PROTECTION_ENABLED=false`), this let an authenticated user make the n8n server issue HTTP requests to arbitrary internal targets.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Set `N8N_SSRF_PROTECTION_ENABLED=true` to enable SSRF filtering for private IP ranges and cloud metadata endpoints.\n- Restrict network egress from the n8n host to limit reachable internal services.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-9w78-79q7-r4fp",
"modified": "2026-07-22T22:01:10Z",
"published": "2026-07-22T22:01:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65593"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access"
}
GHSA-9W8W-FGJG-W972
Vulnerability from github – Published: 2025-01-07 21:30 – Updated: 2026-02-13 18:31I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php
{
"affected": [],
"aliases": [
"CVE-2024-54819"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T20:15:30Z",
"severity": "CRITICAL"
},
"details": "I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php",
"id": "GHSA-9w8w-fgjg-w972",
"modified": "2026-02-13T18:31:21Z",
"published": "2025-01-07T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54819"
},
{
"type": "WEB",
"url": "https://github.com/mkucej/i-librarian-free/commit/ed36f6f258392fa2ec72f9820661ded75d91accc"
},
{
"type": "WEB",
"url": "https://github.com/partywavesec/CVE-2024-55557"
},
{
"type": "WEB",
"url": "https://www.partywave.site/show/research/cve-2024-54819-i-librarian-server-side-request-forgery"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WJQ-F6RC-86WF
Vulnerability from github – Published: 2026-04-08 18:34 – Updated: 2026-09-22 18:33A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
{
"affected": [],
"aliases": [
"CVE-2026-32591"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T18:26:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"id": "GHSA-9wjq-f6rc-86wf",
"modified": "2026-09-22T18:33:03Z",
"published": "2026-04-08T18:34:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24833"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:70267"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32591.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WR2-VJFC-4JQW
Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37** DISPUTED ** mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble."
{
"affected": [],
"aliases": [
"CVE-2018-19047"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-07T05:29:00Z",
"severity": "CRITICAL"
},
"details": "** DISPUTED ** mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a \u0027\u003cimg src=\"http://192.168\u0027 substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating \"If you allow users to pass HTML without sanitising it, you\u0027re asking for trouble.\"",
"id": "GHSA-9wr2-vjfc-4jqw",
"modified": "2022-05-14T01:37:22Z",
"published": "2022-05-14T01:37:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19047"
},
{
"type": "WEB",
"url": "https://github.com/mpdf/mpdf/issues/867"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9WR5-VMCV-4R9G
Vulnerability from github – Published: 2026-07-21 00:30 – Updated: 2026-07-21 18:30FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information
{
"affected": [],
"aliases": [
"CVE-2026-51031"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T22:17:15Z",
"severity": "HIGH"
},
"details": "FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information",
"id": "GHSA-9wr5-vmcv-4r9g",
"modified": "2026-07-21T18:30:55Z",
"published": "2026-07-21T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51031"
},
{
"type": "WEB",
"url": "https://xinyi234.github.io/2026/04/13/FlareSolverr-Server-Side-Request-Forgery-SSRF-Vulnerability-Report"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WRX-MW8F-HX7P
Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2024-04-04 01:57An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.
{
"affected": [],
"aliases": [
"CVE-2019-15728"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-16T17:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.",
"id": "GHSA-9wrx-mw8f-hx7p",
"modified": "2024-04-04T01:57:32Z",
"published": "2022-05-24T16:56:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15728"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/61314"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.