CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,205 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 70 of 85

CVE-2022-45027MEDIUMCVSS 5.3EG 5.3
2023-01-01
perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address.
CVE-2022-37313MEDIUMCVSS 5.3EG 5.3
2022-12-26
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
CVE-2022-3189MEDIUMCVSS 5.3EG 5.3
2022-12-21
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host paramet…
CVE-2022-39055MEDIUMCVSS 5.3EG 5.3
2022-10-18
RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack to discover internal network topology base on query response.
CVE-2022-38648MEDIUMCVSS 5.3EG 5.3
2022-09-22
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
CVE-2022-38398MEDIUMCVSS 5.3EG 5.3
2022-09-22
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.
CVE-2022-35949MEDIUMCVSS 5.3EG 5.3
2022-08-12
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifie…
CVE-2022-32457MEDIUMCVSS 5.3EG 5.3
2022-07-20
Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
CVE-2022-0085MEDIUMCVSS 5.3EG 5.3
2022-06-28
Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
CVE-2017-20106MEDIUMCVSS 5.3EG 5.3
2022-06-28
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-si…
CVE-2021-36761MEDIUMCVSS 5.3EG 5.3
2022-06-21
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
CVE-2022-29188MEDIUMCVSS 5.3EG 5.3
2022-05-21
Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Sm…
CVE-2022-0870MEDIUMCVSS 5.3EG 5.3
2022-03-11
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
CVE-2021-36327MEDIUMCVSS 5.3EG 5.3
2021-11-30
Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make H…
CVE-2021-3553MEDIUMCVSS 5.3EG 5.3
2021-11-24
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpo…
CVE-2021-3552MEDIUMCVSS 5.3EG 5.3
2021-11-24
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools v…
CVE-2021-22969MEDIUMCVSS 5.3EG 5.3
2021-11-19
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the l…
CVE-2021-41792MEDIUMCVSS 5.3EG 5.3
2021-10-21
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformati…
CVE-2020-24327MEDIUMCVSS 5.3EG 5.3
2021-09-23
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
CVE-2020-21122MEDIUMCVSS 5.3EG 5.3
2021-09-15
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
CVE-2020-24141MEDIUMCVSS 5.3EG 5.3
2021-07-07
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can hel…
CVE-2021-28060MEDIUMCVSS 5.3EG 5.3
2021-04-14
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
CVE-2021-28941MEDIUMCVSS 5.3EG 5.3
2021-04-02
Because of no validation on a curl command in MagpieRSS 0.72 in the /extlib/Snoopy.class.inc file, when you send a request to the /scripts/magpie_debug.php or /scripts/magpie_simple.php page, it's possible to request any internal page if y…
CVE-2021-23345MEDIUMCVSS 5.3EG 5.3
2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe …
CVE-2020-35561MEDIUMCVSS 5.3EG 5.3
2021-02-16
An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports.
CVE-2021-25241MEDIUMCVSS 5.3EG 5.3
2021-02-04
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.
CVE-2021-25236MEDIUMCVSS 5.3EG 5.3
2021-02-04
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a specific sweep.
CVE-2020-17513MEDIUMCVSS 5.3EG 5.3
2020-12-14
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
CVE-2020-28978MEDIUMCVSS 5.3EG 5.3
2020-11-30
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.
CVE-2020-28977MEDIUMCVSS 5.3EG 5.3
2020-11-30
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF.
CVE-2020-28976MEDIUMCVSS 5.3EG 5.3
2020-11-30
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
CVE-2020-27626MEDIUMCVSS 5.3EG 5.3
2020-11-16
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
CVE-2020-27624MEDIUMCVSS 5.3EG 5.3
2020-11-16
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
CVE-2020-26811MEDIUMCVSS 5.3EG 5.3
2020-11-10
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further…
CVE-2020-24710MEDIUMCVSS 5.3EG 5.3
2020-10-28
Gophish before 0.11.0 allows SSRF attacks.
CVE-2020-24548MEDIUMCVSS 5.3EG 5.3
2020-08-26
Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Cannot connect to" error messages to inform the attacker about closed ports.
CVE-2020-15819MEDIUMCVSS 5.3EG 5.3
2020-08-08
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.
CVE-2019-20408MEDIUMCVSS 5.3EG 5.3
2020-07-01
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the Jir…
CVE-2020-11453MEDIUMCVSS 5.3EG 5.3
2020-04-02
Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parame…
CVE-2019-4741MEDIUMCVSS 5.3EG 5.3
2020-02-12
IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other att…
CVE-2019-15021MEDIUMCVSS 5.3EG 5.3
2019-10-09
A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easily identify instances of Zingbox Inspectors in a local area network.
CVE-2019-15164MEDIUMCVSS 5.3EG 5.3
2019-10-03
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.
CVE-2019-4262MEDIUMCVSS 5.3EG 5.3
2019-09-26
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the QRadar system, potentially leading to network enumeration or facilitating ot…
CVE-2019-15731MEDIUMCVSS 5.3EG 5.3
2019-09-16
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.
CVE-2019-12996MEDIUMCVSS 5.3EG 5.3
2019-09-10
In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe.
CVE-2019-1872MEDIUMCVSS 5.3EG 5.3
2019-06-05
A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability i…
CVE-2018-1000067MEDIUMCVSS 5.3EG 5.3
2018-02-16
An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.
CVE-2018-2370MEDIUMCVSS 5.3EG 5.3
2018-02-14
Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allow a malicious user to use common techniques to determine which ports are in use …
CVE-2017-16865MEDIUMCVSS 5.3EG 5.3
2018-01-17
The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). When running in an environment like Amazon EC2, this flaw mayb…
CVE-2017-15943MEDIUMCVSS 5.3EG 5.3
2017-12-11
The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduc…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →