CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- unknown smartaipressSmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image7.7 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities4.3 Medium
- brokercap bifrostBifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL8.7 High
- coderamp-labs gitingestGitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure8.3 High
- dataelement bishengBISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback8.8 High
- netscaler gatewayPortkey AI Gateway Server-Side Request Forgery via /v1/proxy/*8.7 High
- qwenlm qwen-agentQwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL8.7 High
- logto-io logtoLogto Server-Side Request Forgery via OIDC SSO Connector Issuer URL8.2 High
- logto-io logtoLogto Server-Side Request Forgery via webhook test endpoint8.2 High
- kubeflow pipelinesKubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true10.0 Critical
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'5.3 Medium
- budibase serverBudibase Server before 3.41.3 SSRF via Query Import7.1 High
- budibase serverBudibase Server before 3.41.3 SSRF with Credential Leakage8.3 High
- budibase serverBudibase backend-core SSRF via incomplete default blacklist7.1 High
- siyuan-note siyuanSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU8.4 High
- synology chat serverA server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5...4.3 Medium
- wallabag android-appThe wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS...8.8 High
- wallabagwallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled...6.4 Medium
- adobe dimensionDimension Server-Side Request Forgery via Email Server Test Settings5.1 Medium
- adobe dimensionDimension Server-Side Request Forgery via Remote Backup Connection Test5.3 Medium
- adobe dimensionDimension Blind SSRF via Database Test Connection Feature5.1 Medium
- adobe dimensionDimension SSRF via FTP Server Test Connection5.1 Medium
- cyberchitta scrapling-fetch-mcpcyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery5.1 Medium
- spring cloud function, vmware spring cloud function +1 morePotential arbitrary file read and SSRF vulnerability in Spring Cloud Function2.0 Low
- cc-tweakedCC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection6.9 Medium
- gitlab, gitlab ai gateway +1 moreServer-Side Request Forgery (SSRF) in GitLab AI Gateway8.2 High
- gitlab ai gatewayServer-Side Request Forgery (SSRF) in GitLab AI Gateway8.2 High
- wwbn avideoAVideo SSRF Guard Bypass via IPv6 Transition Addresses6.9 Medium
- apify actors-mcp-serverApify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton8.7 High
- mcp-usemcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL8.7 High
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages6.5 Medium
- spring cloud gateway, vmware spring cloud gateway +1 moreSpring Cloud Gateway SSRF and native file access with gRPC7.7 High
- spring integration, vmware spring integration +1 moreUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false6.3 Medium
- ddfourtwo sentry-selfhosted-mcpddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery6.9 Medium
- hclsoftware connectionsHCL Connections is vulnerable to server-side request forgery (SSRF)3.7 Low
- weblateorg weblateWeblate: DNS rebinding in VCS operations allows server-side request forgery3.5 Low
- dell cloud disaster recoveryDell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery ...4.3 Medium
- oneuptimeOneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL7.1 High
- kazuph mcp-fetchmcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets8.7 High
- No product listedThe device metadata import interface /device/instance/{productId}/property-metadata/import of...9.1 Critical
- No product listedZyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService...9.1 Critical
- chainlitChainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls6.3 Medium
- chainlitChainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access7.2 High
- dradis dradis-ceDradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address7.1 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)10.0 Critical
utcp-httpPyPIutcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion7.1 Highutcp-httpPyPIutcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target8.2 High- jfrog artifactorySSRF In CocoaPods Via JFrog Artifactory External Dependency3.5 Low
- jfrog artifactoryServer-Side Request Forgery Via VCS remote download in JFrog Artifactory8.5 High
- mervinpraison praisonaiPraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation6.8 Medium
- Show moreLoading…