CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- signalk signalk-serverSignal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon2.3 Low
- nimble-platform common@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass8.9 High
- eventscheduleEvent Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/…6.5 Medium
- onphase formsServer-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure8.7 High
- microsoft azure ai foundryAzure AI Foundry Elevation of Privilege Vulnerability7.7 High
- authlibAuthlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF5.4 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-88.7 High
- phpoffice phpspreadsheetPhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading6.4 Medium
- py-pdf fpdf2fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content5.8 Medium
- crawlseocrawlseo before 0.2.4 Server-Side Request Forgery via Crawler5.3 Medium
- bulwarkmail webmailRoundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side...7.2 High
- wwbn avideoWWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect5.3 Medium
- leomoon-studios wiki-goleomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery5.3 Medium
- No product listedHarnessRouter Targets Test Endpoint app.py server-side request forgery5.3 Medium
- localaiLocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects9.2 Critical
- airbyteAirbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability7.7 High
- airbyteAirbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability7.7 High
- nomachineNoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability7.2 High
- red hat openshift ai (rhoai)Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding6.5 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range5.3 Medium
- sveltejs kitSvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks6.9 Medium
- rapid7 metasploit frameworkMetasploit Framework HTTP Redirect Server-Side Request Forgery4.7 Medium
- rapid7 metasploit frameworkMetasploit Framework FTP PASV Response SSRF4.7 Medium
- a2aproject a2a-rsa2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery6.9 Medium
- bulwarkmail webmailBulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint7.5 High
- @apostrophecms ai-helper, apostrophecms apostrophe +1 moreApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF4.3 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)6.4 Medium
- a2aproject a2a-javaA2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery5.8 Medium
- red hat streams for apache kafka 3Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname8.1 High
- eclipse foundation csi - piajwks_uri from the OIDC discovery document is fetched without checking its origin or scheme5.1 Medium
- typo3 extension "kitodo.presentation"Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)6.9 Medium
- ibm contextforge, contextforge mcp gateway +1 moreIBM ContextForge MCP Gateway is affected by server-side request forgery5.4 Medium
- misp misp-modulesMISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()6.3 Medium
- tibillet lespassTiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery2.1 Low
- smrealms smrsmrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery5.3 Medium
- ptbsare anx-calibre-managerptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery5.3 Medium
- agit8or1 clientst0ragit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery5.3 Medium
- unclecode crawl4aiCrawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo6.9 Medium
- crewaiinc crewai-toolscrewai-tools through 1.15.28 SSRF via SeleniumScrapingTool8.3 High
- krayin laravel-crmKrayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding2.1 Low
- sgl-project sglangSGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker6.9 Medium
- aleksey-hoffman sigma file managerSigma File Manager through 2.2.0 SSRF via Extension Download Commands5.3 Medium
- tombursch kitchenowlKitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch5.3 Medium
- apache camelApache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address8.2 High
- apache software foundation camelApache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure5.9 Medium
- apache software foundation kylinApache Kylin: job-driver UI proxy SSRF6.5 Medium
- alexta69 metubealexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery6.3 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.88 - Subscriber+ SSRF5.0 Medium
- tandoorrecipes recipesTandoor Recipes: Blind SSRF via AI provider URL (api_base)7.7 High
- Show moreLoading…