CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6225 vulnerabilities reference this CWE, most recent first.
GHSA-HMFP-MWGF-VXWX
Vulnerability from github – Published: 2025-04-18 15:31 – Updated: 2025-04-18 15:31A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-3787"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T10:15:15Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-hmfp-mwgf-vxwx",
"modified": "2025-04-18T15:31:38Z",
"published": "2025-04-18T15:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3787"
},
{
"type": "WEB",
"url": "https://github.com/KKDT12138/CVE/blob/main/cve6.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305610"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305610"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553731"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HMFX-4V44-9QW9
Vulnerability from github – Published: 2026-08-25 15:02 – Updated: 2026-08-25 15:02Summary
The webhook_url field in the Jobs API silently passes validation when DNS resolution fails (socket.gaierror), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.
Details
The validator catches socket.gaierror and silently allows the URL:
# src/praisonai/praisonai/jobs/models.py:55
try:
ip = socket.gethostbyname(hostname)
ip_obj = ipaddress.ip_address(ip)
if ip_obj.is_private or ip_obj.is_loopback:
raise ValueError("private address")
except socket.gaierror:
pass # BUG: DNS failure silently ignored → SSRF bypass
The HTTP call is made later with no re-validation:
# src/praisonai/praisonai/jobs/executor.py:402
async with httpx.AsyncClient() as client:
await client.post(job.webhook_url, ...) # no second IP check
Proof of Concept
DNS rebinding flow:
1. Register attacker.com with TTL=1s → resolves to 1.2.3.4 (public IP)
2. Submit job: webhook_url=http://attacker.com/callback
3. Validation passes (public IP)
4. Switch DNS: attacker.com → 127.0.0.1
5. Job completes → server POSTs to 127.0.0.1 → internal SSRF
Unresolvable domain bypass (no DNS rebinding required):
curl -X POST http://:8005/api/v1/runs \
-d '{"prompt":"run","webhook_url":"http://unresolvable.internal/cb","agent_yaml":"..."}'
# Validation: gaierror → pass → URL accepted
Impact
SSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., http://169.254.169.254/). Exploitable without authentication.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.6.48"
},
"package": {
"ecosystem": "PyPI",
"name": "PraisonAI"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.58"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55535"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-25T15:02:04Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker\u0027s domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.\n\n### Details\nThe validator catches `socket.gaierror` and silently allows the URL:\n\n```python\n# src/praisonai/praisonai/jobs/models.py:55\ntry:\n ip = socket.gethostbyname(hostname)\n ip_obj = ipaddress.ip_address(ip)\n if ip_obj.is_private or ip_obj.is_loopback:\n raise ValueError(\"private address\")\nexcept socket.gaierror:\n pass # BUG: DNS failure silently ignored \u2192 SSRF bypass\n```\n\nThe HTTP call is made later with no re-validation:\n\n```python\n# src/praisonai/praisonai/jobs/executor.py:402\nasync with httpx.AsyncClient() as client:\n await client.post(job.webhook_url, ...) # no second IP check\n```\n\n### Proof of Concept\n\n**DNS rebinding flow:**\n1. Register `attacker.com` with TTL=1s \u2192 resolves to `1.2.3.4` (public IP)\n2. Submit job: `webhook_url=http://attacker.com/callback`\n3. Validation passes (public IP)\n4. Switch DNS: `attacker.com` \u2192 `127.0.0.1`\n5. Job completes \u2192 server POSTs to `127.0.0.1` \u2192 internal SSRF\n\n**Unresolvable domain bypass (no DNS rebinding required):**\n\n```bash\ncurl -X POST http://:8005/api/v1/runs \\\n -d \u0027{\"prompt\":\"run\",\"webhook_url\":\"http://unresolvable.internal/cb\",\"agent_yaml\":\"...\"}\u0027\n# Validation: gaierror \u2192 pass \u2192 URL accepted\n```\n\n### Impact\nSSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., `http://169.254.169.254/`). Exploitable without authentication.",
"id": "GHSA-hmfx-4v44-9qw9",
"modified": "2026-08-25T15:02:04Z",
"published": "2026-08-25T15:02:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9"
},
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
},
{
"type": "PACKAGE",
"url": "https://github.com/MervinPraison/PraisonAI"
},
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation"
}
GHSA-HMQR-J9C3-8H75
Vulnerability from github – Published: 2022-05-14 01:20 – Updated: 2025-04-20 03:37In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
{
"affected": [],
"aliases": [
"CVE-2017-9066"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-18T14:29:00Z",
"severity": "HIGH"
},
"details": "In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.",
"id": "GHSA-hmqr-j9c3-8h75",
"modified": "2025-04-20T03:37:51Z",
"published": "2022-05-14T01:20:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9066"
},
{
"type": "WEB",
"url": "https://github.com/WordPress/WordPress/commit/76d77e927bb4d0f87c7262a50e28d84e01fd2b11"
},
{
"type": "WEB",
"url": "https://codex.wordpress.org/Version_4.7.5"
},
{
"type": "WEB",
"url": "https://twitter.com/skansing/status/865362551097393153"
},
{
"type": "WEB",
"url": "https://wordpress.org/news/2017/05/wordpress-4-7-5"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/8815"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4090"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98509"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038520"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HP2Q-C8XQ-V8QV
Vulnerability from github – Published: 2026-07-02 15:32 – Updated: 2026-07-02 15:32A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-55113"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T15:17:05Z",
"severity": "HIGH"
},
"details": "A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.",
"id": "GHSA-hp2q-c8xq-v8qv",
"modified": "2026-07-02T15:32:13Z",
"published": "2026-07-02T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55113"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HP6R-MRH8-47VQ
Vulnerability from github – Published: 2026-09-02 00:31 – Updated: 2026-09-08 15:31A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
{
"affected": [],
"aliases": [
"CVE-2026-76851"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T22:17:13Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.",
"id": "GHSA-hp6r-mrh8-47vq",
"modified": "2026-09-08T15:31:29Z",
"published": "2026-09-02T00:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76851"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.20"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.14"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.11"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.7"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HP7X-282P-HHR9
Vulnerability from github – Published: 2022-05-14 02:57 – Updated: 2024-01-09 21:25A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.3"
},
"package": {
"ecosystem": "Maven",
"name": "de.tracetronic.jenkins.plugins:ecutest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1999026"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T21:25:56Z",
"nvd_published_at": "2018-08-01T13:29:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.",
"id": "GHSA-hp7x-282p-hhr9",
"modified": "2024-01-09T21:25:56Z",
"published": "2022-05-14T02:57:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1999026"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/ecutest-plugin/commit/943c4d3c8df521eb94fb99429717e3920c6fc7f7"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/ecutest-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-07-30/#SECURITY-994"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227115310/http://www.securityfocus.com/bid/104960"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerability"
}
GHSA-HP98-W9MH-2G6Q
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2022-05-24 16:55The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.
{
"affected": [],
"aliases": [
"CVE-2019-8451"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-11T14:15:00Z",
"severity": "MODERATE"
},
"details": "The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.",
"id": "GHSA-hp98-w9mh-2g6q",
"modified": "2022-05-24T16:55:57Z",
"published": "2022-05-24T16:55:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8451"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-69793"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPJ8-847G-HQ6H
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services allows Server Side Request Forgery. This issue affects Car Repair Services: from n/a through 5.0.
{
"affected": [],
"aliases": [
"CVE-2025-30997"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:38Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services allows Server Side Request Forgery. This issue affects Car Repair Services: from n/a through 5.0.",
"id": "GHSA-hpj8-847g-hq6h",
"modified": "2026-04-01T18:35:20Z",
"published": "2025-06-06T15:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30997"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/car-repair-services/vulnerability/wordpress-car-repair-services-5-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPP2-R5C8-CWWC
Vulnerability from github – Published: 2026-03-08 12:30 – Updated: 2026-03-08 12:30A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)
{
"affected": [],
"aliases": [
"CVE-2026-3733"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-08T11:15:50Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: \"Access token security verification is required.\" (translated from Chinese)",
"id": "GHSA-hpp2-r5c8-cwwc",
"modified": "2026-03-08T12:30:27Z",
"published": "2026-03-08T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3733"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3924"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3924#issue-3987941359"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.349711"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.349711"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.767226"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HPPC-RPFP-R8QW
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2023-08-01 23:00A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7913"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-01T23:00:35Z",
"nvd_published_at": "2019-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.",
"id": "GHSA-hppc-rpfp-r8qw",
"modified": "2023-08-01T23:00:35Z",
"published": "2022-05-24T16:52:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7913"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7913.yaml"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition SSRF vulnerability"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.