CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,095 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 7 of 82

CVE-2020-8540CRITICALCVSS 9.8EG 9.8
2020-03-11
An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted D…
CVE-2019-12443CRITICALCVSS 9.8EG 9.8
2020-03-10
An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.
CVE-2020-10212CRITICALCVSS 9.8EG 9.8
2020-03-07
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF…
CVE-2020-8128CRITICALCVSS 9.8EG 9.8
2020-02-14
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
CVE-2020-3938CRITICALCVSS 9.8EG 9.8
2020-02-04
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.
CVE-2013-4864CRITICALCVSS 9.8EG 9.8
2020-01-28
MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery (SSRF) issue.
CVE-2019-5464CRITICALCVSS 9.8EG 9.8
2020-01-28
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.
CVE-2019-16948CRITICALCVSS 9.8EG 9.8
2019-11-13
An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the interna…
CVE-2019-18394CRITICALCVSS 9.8EG 9.8
2019-10-24
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
CVE-2019-18355CRITICALCVSS 9.8EG 9.8
2019-10-23
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.
CVE-2019-17670CRITICALCVSS 9.8EG 9.8
2019-10-17
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
CVE-2019-17669CRITICALCVSS 9.8EG 9.8
2019-10-17
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
CVE-2019-13335CRITICALCVSS 9.8EG 9.8
2019-10-02
SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF.
CVE-2019-15494CRITICALCVSS 9.8EG 9.8
2019-08-23
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
CVE-2019-0345CRITICALCVSS 9.8EG 9.8
2019-08-14
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application serv…
CVE-2019-14255CRITICALCVSS 9.8EG 9.8
2019-08-08
A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to internal endpoints.
CVE-2019-14704CRITICALCVSS 9.8EG 9.8
2019-08-06
An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the uploadfile field.
CVE-2019-9827CRITICALCVSS 9.8EG 9.8
2019-07-03
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
CVE-2019-12852CRITICALCVSS 9.8EG 9.8
2019-07-03
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
CVE-2019-11027CRITICALCVSS 9.8EG 9.8
2019-06-10
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application …
CVE-2018-17198CRITICALCVSS 9.8EG 9.8
2019-05-28
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external …
CVE-2019-11066CRITICALCVSS 9.8EG 9.8
2019-05-10
openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
CVE-2019-11565CRITICALCVSS 9.8EG 9.8
2019-04-27
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
CVE-2019-4203CRITICALCVSS 9.8EG 9.8
2019-04-15
IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124.
CVE-2019-3395CRITICALCVSS 9.8EG 9.8
2019-03-25
The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version fo…
CVE-2018-20596CRITICALCVSS 9.8EG 9.8
2018-12-30
Jspxcms v9.0.0 allows SSRF.
CVE-2018-18753CRITICALCVSS 9.8EG 9.8
2018-10-29
Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.
CVE-2018-14728CRITICALCVSS 9.8EG 9.8
2018-08-03
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
CVE-2018-14514CRITICALCVSS 9.8EG 9.8
2018-07-23
An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact.
CVE-2018-0403CRITICALCVSS 9.8EG 9.8
2018-07-18
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040.
CVE-2018-0399CRITICALCVSS 9.8EG 9.8
2018-07-18
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug IDs: CSCvg71044.
CVE-2018-0398CRITICALCVSS 9.8EG 9.8
2018-07-18
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.
CVE-2018-12571CRITICALCVSS 9.8EG 9.8
2018-07-05
uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly c…
CVE-2018-12678CRITICALCVSS 9.8EG 9.8
2018-06-22
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SS…
CVE-2018-11586CRITICALCVSS 9.8EG 9.8
2018-06-05
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVE-2018-11031CRITICALCVSS 9.8EG 9.8
2018-05-14
application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]=get POST request.
CVE-2018-9919CRITICALCVSS 9.8EG 9.8
2018-05-02
A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution, because /vendor/phpd…
CVE-2018-8939CRITICALCVSS 9.8EG 9.8
2018-05-01
An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can submit specially crafted requests via the NmAPI executable to (1) gain unauthorized access to the WhatsUp Gold system, (2) obtain i…
CVE-2017-14323CRITICALCVSS 9.8EG 9.8
2018-04-10
SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile param…
CVE-2017-16614CRITICALCVSS 9.8EG 9.8
2018-03-30
SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php …
CVE-2014-3990CRITICALCVSS 9.8EG 9.8
2018-03-20
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitra…
CVE-2018-7667CRITICALCVSS 9.8EG 9.8
2018-03-05
Adminer through 4.3.1 has SSRF via the server parameter.
CVE-2017-1000237CRITICALCVSS 9.8EG 9.8
2017-11-17
I, Librarian version <=4.6 & 4.7 is vulnerable to Server-Side Request Forgery in the ajaxsupplement.php resulting in the attacker being able to reset any user's password.
CVE-2017-0907CRITICALCVSS 9.8EG 9.8
2017-11-13
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromi…
CVE-2017-0906CRITICALCVSS 9.8EG 9.8
2017-11-13
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other criti…
CVE-2017-0905CRITICALCVSS 9.8EG 9.8
2017-11-13
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in…
CVE-2017-0889CRITICALCVSS 9.8EG 9.8
2017-11-13
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
CVE-2017-9458CRITICALCVSS 9.8EG 9.8
2017-09-07
XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to ob…
CVE-2004-2061CRITICALCVSS 9.8EG 9.8
2004-07-27
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.
CVE-2002-1484CRITICALCVSS 9.8EG 9.8
2003-04-22
DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, …

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →