CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 51 of 85

CVE-2022-2756MEDIUMCVSS 6.5EG 6.5
2022-08-10
Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
CVE-2022-24406MEDIUMCVSS 6.5EG 6.5
2022-07-27
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
CVE-2022-23071MEDIUMCVSS 6.5EG 6.5
2022-06-19
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file…
CVE-2022-28217MEDIUMCVSS 6.5EG 6.5
2022-06-13
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSR…
CVE-2022-1398MEDIUMCVSS 6.5EG 6.5
2022-05-16
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform bl…
CVE-2022-29848MEDIUMCVSS 6.5EG 6.5
2022-05-11
In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible b…
CVE-2022-29942MEDIUMCVSS 6.5EG 6.5
2022-05-04
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in …
CVE-2022-28090MEDIUMCVSS 6.5EG 6.5
2022-05-04
Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.
CVE-2020-27375MEDIUMCVSS 6.5EG 6.5
2022-04-07
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
CVE-2021-39051MEDIUMCVSS 6.5EG 6.5
2022-03-14
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the hos…
CVE-2022-24333MEDIUMCVSS 6.5EG 6.5
2022-02-25
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
CVE-2021-23718MEDIUMCVSS 6.5EG 6.5
2021-11-22
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
CVE-2021-35512MEDIUMCVSS 6.5EG 6.5
2021-10-21
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.
CVE-2021-39867MEDIUMCVSS 6.5EG 6.5
2021-10-05
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.
CVE-2021-37223MEDIUMCVSS 6.5EG 6.5
2021-10-05
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application.…
CVE-2021-41385MEDIUMCVSS 6.5EG 6.5
2021-09-27
The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details via SSRF.
CVE-2021-21993MEDIUMCVSS 6.5EG 6.5
2021-09-23
The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POS…
CVE-2021-3758MEDIUMCVSS 6.5EG 6.5
2021-09-02
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2020-25353MEDIUMCVSS 6.5EG 6.5
2021-08-20
A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
CVE-2021-33213MEDIUMCVSS 6.5EG 6.5
2021-07-14
An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
CVE-2021-20483MEDIUMCVSS 6.5EG 6.5
2021-06-16
IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197…
CVE-2020-28943MEDIUMCVSS 6.5EG 6.5
2021-04-30
OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
CVE-2021-20480MEDIUMCVSS 6.5EG 6.5
2021-04-08
IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM …
CVE-2020-15809MEDIUMCVSS 6.5EG 6.5
2021-03-24
spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and …
CVE-2021-3204MEDIUMCVSS 6.5EG 6.5
2021-02-19
SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.
CVE-2020-28463MEDIUMCVSS 6.5EG 6.5
2021-02-18
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Downlo…
CVE-2020-36200MEDIUMCVSS 6.5EG 6.5
2021-01-26
TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.
CVE-2020-35850MEDIUMCVSS 6.5EG 6.5
2020-12-30
An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think [it] is a big real-life issue.
CVE-2019-14476MEDIUMCVSS 6.5EG 6.5
2020-12-16
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems.
CVE-2020-24815MEDIUMCVSS 6.5EG 6.5
2020-11-24
A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the l…
CVE-2020-25820MEDIUMCVSS 6.5EG 6.5
2020-10-21
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
CVE-2020-5784MEDIUMCVSS 6.5EG 6.5
2020-10-01
Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs.
CVE-2020-24570MEDIUMCVSS 6.5EG 6.5
2020-09-30
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a cr…
CVE-2020-16171MEDIUMCVSS 6.5EG 6.5
2020-09-21
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued…
CVE-2020-4632MEDIUMCVSS 6.5EG 6.5
2020-09-04
IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to submit or control server requests. IBM X-F…
CVE-2020-17386MEDIUMCVSS 6.5EG 6.5
2020-08-25
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
CVE-2020-8544MEDIUMCVSS 6.5EG 6.5
2020-06-16
OX App Suite through 7.10.3 allows SSRF.
CVE-2020-10791MEDIUMCVSS 6.5EG 6.5
2020-03-25
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) …
CVE-2020-8138MEDIUMCVSS 6.5EG 6.5
2020-03-20
A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.
CVE-2019-20055MEDIUMCVSS 6.5EG 6.5
2019-12-29
LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets.
CVE-2018-19495MEDIUMCVSS 6.5EG 6.5
2019-07-10
An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration.
CVE-2019-6981MEDIUMCVSS 6.5EG 6.5
2019-05-29
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
CVE-2018-12609MEDIUMCVSS 6.5EG 6.5
2019-01-30
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
CVE-2018-1000422MEDIUMCVSS 6.5EG 6.5
2019-01-09
An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server w…
CVE-2018-1000421MEDIUMCVSS 6.5EG 6.5
2019-01-09
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-s…
CVE-2018-20528MEDIUMCVSS 6.5EG 6.5
2018-12-28
JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.
CVE-2018-19651MEDIUMCVSS 6.5EG 6.5
2018-11-28
admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) via a what=importurl&url= request with an http or https URL. This also allows reading local files with a file: URL.
CVE-2017-16790MEDIUMCVSS 6.5EG 6.5
2018-08-06
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one ar…
CVE-2018-1999026MEDIUMCVSS 6.5EG 6.5
2018-08-01
A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.
CVE-2018-1000606MEDIUMCVSS 6.5EG 6.5
2018-06-26
A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →