CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,133 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 34 of 83

CVE-2022-0132HIGHCVSS 7.5EG 7.5
2022-01-10
peertube is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2021-27738HIGHCVSS 7.5EG 7.5
2022-01-06
All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as …
CVE-2021-22056HIGHCVSS 7.5EG 7.5
2021-12-20
VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the f…
CVE-2021-43296HIGHCVSS 7.5EG 7.5
2021-11-30
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
CVE-2021-22970HIGHCVSS 7.5EG 7.5
2021-11-19
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can piv…
CVE-2021-37104HIGHCVSS 7.5EG 7.5
2021-09-28
There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability is due to insufficient validation of parameters while dealing with some messages. A successful exploit could allow the …
CVE-2021-41587HIGHCVSS 7.5EG 7.5
2021-09-24
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
CVE-2021-41586HIGHCVSS 7.5EG 7.5
2021-09-24
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
CVE-2021-37419HIGHCVSS 7.5EG 7.5
2021-09-21
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
CVE-2021-28910HIGHCVSS 7.5EG 7.5
2021-09-09
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server.
CVE-2020-20341HIGHCVSS 7.5EG 7.5
2021-09-01
YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
CVE-2021-22027HIGHCVSS 7.5EG 7.5
2021-08-30
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request …
CVE-2021-22026HIGHCVSS 7.5EG 7.5
2021-08-30
The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request …
CVE-2020-14160HIGHCVSS 7.5EG 7.5
2021-08-26
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
CVE-2020-23079HIGHCVSS 7.5EG 7.5
2021-07-12
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVE-2020-20582HIGHCVSS 7.5EG 7.5
2021-07-08
A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information.
CVE-2020-24149HIGHCVSS 7.5EG 7.5
2021-07-07
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
CVE-2021-33571HIGHCVSS 7.5EG 7.5
2021-06-08
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that…
CVE-2020-35970HIGHCVSS 7.5EG 7.5
2021-06-03
An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read.
CVE-2021-33511HIGHCVSS 7.5EG 7.5
2021-05-21
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
CVE-2021-31910HIGHCVSS 7.5EG 7.5
2021-05-11
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
CVE-2020-22002HIGHCVSS 7.5EG 7.5
2021-04-29
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to cons…
CVE-2021-24150HIGHCVSS 7.5EG 7.5
2021-04-05
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
CVE-2021-22696HIGHCVSS 7.5EG 7.5
2021-04-02
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "r…
CVE-2020-19613HIGHCVSS 7.5EG 7.5
2021-04-01
Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.
CVE-2020-35558HIGHCVSS 7.5EG 7.5
2021-02-16
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some inf…
CVE-2020-35667HIGHCVSS 7.5EG 7.5
2021-02-03
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
CVE-2020-29166HIGHCVSS 7.5EG 7.5
2021-02-03
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.
CVE-2020-23776HIGHCVSS 7.5EG 7.5
2021-01-26
A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' v…
CVE-2020-24641HIGHCVSS 7.5EG 7.5
2021-01-15
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an …
CVE-2020-26032HIGHCVSS 7.5EG 7.5
2020-12-28
An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET req…
CVE-2020-8464HIGHCVSS 7.5EG 7.5
2020-12-17
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normall…
CVE-2019-17566HIGHCVSS 7.5EG 7.5
2020-11-12
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying serv…
CVE-2020-28043HIGHCVSS 7.5EG 7.5
2020-11-02
MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
CVE-2020-9298HIGHCVSS 7.5EG 7.5
2020-08-28
The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
CVE-2020-15823HIGHCVSS 7.5EG 7.5
2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15879HIGHCVSS 7.5EG 7.5
2020-07-21
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).
CVE-2020-8205HIGHCVSS 7.5EG 7.5
2020-07-20
The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
CVE-2020-13650HIGHCVSS 7.5EG 7.5
2020-06-15
An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that allows use of the application as a proxy. Sent to an external server, a forged …
CVE-2020-9645HIGHCVSS 7.5EG 7.5
2020-06-12
Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2020-9643HIGHCVSS 7.5EG 7.5
2020-06-12
Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2020-3769HIGHCVSS 7.5EG 7.5
2020-03-25
Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-13121HIGHCVSS 7.5EG 7.5
2020-03-10
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access…
CVE-2007-6758HIGHCVSS 7.5EG 7.5
2020-01-23
Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
CVE-2019-19835HIGHCVSS 7.5EG 7.5
2020-01-23
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2020-1925HIGHCVSS 7.5EG 7.5
2020-01-09
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks …
CVE-2019-17400HIGHCVSS 7.5EG 7.5
2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2017-18638HIGHCVSS 7.5EG 7.5
2019-10-11
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to thi…
CVE-2019-15730HIGHCVSS 7.5EG 7.5
2019-09-16
An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which woul…
CVE-2019-15728HIGHCVSS 7.5EG 7.5
2019-09-16
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network reso…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →