{"id":"CVE-2022-42149","aliases":["EUVD-2022-45226","GHSA-v6hf-4fpr-7xxc"],"status":"published","title":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller...","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02704,"percentile":0.86056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2022-10-17T00:00:00Z","modified":"2026-10-28T02:30:22Z","exploits":[{"source":"nuclei","id":"CVE-2022-42149","title":"kkFileView 4.0 - Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42149.yaml"}],"products":[{"vendor":"keking","product":"kkfileview"}],"references":[{"url":"https://github.com/xiaojiangxl/paper/blob/main/kkFileView/ssrf_vul_en.md","tags":["x_transferred","Broken Link","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42149","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v6hf-4fpr-7xxc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42149.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-42149","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-14T20:50:37.368Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45226","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-14T20:50:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:47.525663Z"}],"ghsa":[{"id":"GHSA-v6hf-4fpr-7xxc","title":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller...","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","status":"published","published":"2022-10-18T12:00:32Z","modified":"2023-02-01T05:08:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2022-42149","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","status":"published","published":"2022-10-17T20:15:10.13Z","modified":"2026-06-17T05:04:26.78Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"CVE-2022-42149","description":"kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2026-10-28T02:30:22.502284883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.186787Z"}]}}