CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
Also known as Confused Deputy.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- giteaGitea fork workflow approval bypass through maintainer-triggered events9.8 Critical
- google chromeConfused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote...8.3 High
- google chromeConfused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote...5.4 Medium
- google chromeConfused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed...4.3 Medium
- google chromeConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote...8.1 High
- google chromeConfused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...8.3 High
- google chromeConfused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote...7.1 High
- google chromeConfused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local...4.4 Medium
- google chromeConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeConfused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...6.5 Medium
- google androidIn Settings, there is a possible permission bypass due to a confused deputy. This could lead to...7.8 High
- moby buildkitBuildKit improperly handles special files in build snapshots6.0 Medium
- @capacitor android, ios, ionic-team capacitor +2 more +4 moreCapacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path9.3 Critical
- google androidIn dialInternal in multiple locations, there is a possible permission bypass due to a confused...7.8 High
- axiosAxios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF7.0 High
- axiosAxios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection7.6 High
- elastic kibanaUnintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation7.3 High
- kyvernokyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath9.4 Critical
- cap-go capgo.appCapgo Build Upload Proxy Authorization Bypass via TUS Resource8.7 High
- google chromeConfused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...4.3 Medium
- google chromeConfused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local...6.5 Medium
- red hat openshift container platform 4, openshift container platform 4.17, openshift container platform 4.18 +4 more +6 moreOpenshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding7.2 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path7.4 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue8.6 High
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability9.9 Critical
- nceas metacatMetacat acts as unintended proxy to backend Apache SOLR engine5.8 Medium
- nuxt-modules og-imageNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter6.9 Medium
- corednsCoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP7.5 High
- google chromeConfused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a...4.8 Medium
- red hat build of apache camel - hawtio 4Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname6.3 Medium
- apple ipados, macos, tvos +4 more +6 moreA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26...5.5 Medium
- google chromeConfused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...4.2 Medium
- google chromeConfused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...8.3 High
- google chromeConfused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...3.1 Low
- google chromeConfused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote...5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreMicrosoft Windows Speech Tampering Vulnerability5.5 Medium
- snowflake connector for .net, connector for python, go driver +7 more +9 moreWorkload identity attestation generated before login host validation in Snowflake drivers8.2 High
- simstudioai simSim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path5.3 Medium
- google chromeConfused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75...5.3 Medium
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 moreA Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...10.0 Critical
- google androidIn platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due...6.7 Medium
- google androidIn ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a...6.7 Medium
- google androidIn multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a...6.7 Medium
- google androidIn multiple files, there is a possible permission bypass due to a confused deputy. This could...6.7 Medium
- google androidIn multiple files, there is a possible out-of-bounds read due to type confusion. This could lead...8.4 High
- google androidIn multiple files, there is a possible way to obtain signatures due to type confusion. This could...8.4 High
- google androidIn VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to...7.8 High
- google androidIn CPM, there is a possible permission bypass due to a confused deputy. This could lead to local...6.7 Medium
- google androidIn gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused...6.7 Medium
- google androidIn onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a...7.8 High
- Show moreLoading…