{"id":"CVE-2023-25230","aliases":["EUVD-2023-29193","GHSA-cv25-4wmr-rxpj"],"status":"published","title":"loonflow r2.0.14 is vulnerable to server-side request forgery (SSRF).","description":"A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00654,"percentile":0.51785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2023-03-07T00:00:00Z","modified":"2026-10-28T02:30:46Z","products":[{"vendor":"loonflow_project","product":"loonflow"}],"references":[{"url":"https://github.com/blackholll/loonflow/issues/402","tags":["x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25230","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cv25-4wmr-rxpj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25230.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-25230","description":"A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.","status":"published","published":"2023-03-07T00:00:00Z","modified":"2024-08-02T11:18:36.102Z","updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29193","description":"A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.","status":"published","published":"2023-03-07T00:00:00Z","modified":"2024-08-02T11:18:36Z","updated_at":"2026-11-03T03:50:07.32318Z"}],"ghsa":[{"id":"GHSA-cv25-4wmr-rxpj","title":"loonflow r2.0.14 is vulnerable to server-side request forgery (SSRF).","description":"loonflow r2.0.14 is vulnerable to server-side request forgery (SSRF).","status":"published","published":"2023-03-07T18:30:39Z","modified":"2023-03-22T05:03:58Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:54:23.065737Z"}],"nvd":[{"id":"CVE-2023-25230","description":"A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.","status":"published","published":"2023-03-07T17:15:12.757Z","modified":"2026-06-17T05:40:58.273Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-25230","description":"A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hook_url parameter.","status":"published","published":"2023-03-07T00:00:00Z","modified":"2026-10-28T02:30:46.993394025Z","updated_at":"2026-11-02T15:44:30.709518Z"}]}}