CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.1 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.3 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.5 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.3 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.8 Medium
- chartbrewChartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections9.1 Critical
- chartbrewChartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)7.0 High
- bubka 2fauth2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)5.9 Medium
- bubka 2fauth2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets4.9 Medium
- open-wanderer wandererWanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access10.0 Critical
- monogramm erpnext ocrERPNext OCR 1.1.1 Path Traversal and SSRF via read_document7.1 High
- yuzutech krokiKroki Mermaid companion SSRF via flowchart image URLs5.0 Medium
- freescout-help-desk freescoutFreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks8.2 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON...4.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories5.3 Medium
- infiniflow ragflowRAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter5.3 Medium
- langgenius difyDify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints7.2 High
- agenta-ai agentaAgenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token8.4 High
- wazuhWazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination8.2 High
- wazuhWazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination6.3 Medium
- apache software foundation jamesApache James: SSRF filter bypass in the JMAP PushSubscription web-push client9.1 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from...5.4 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary...6.8 Medium
- foxit software inc. workspaceServer-Side Request Forgery in Foxit Workspace File Upload7.7 High
- foxit software inc. workspaceServer-Side Request Forgery in Foxit Workspace PDF Export7.7 High
- kubeflow pipelinesKubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints8.6 High
- kubeflow pipelinesKubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator8.6 High
- kubeflow pipelinesKubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy5.8 Medium
- kubeflow pipelinesKubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation5.0 Medium
- kurrent-io kurrentdbKurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF6.9 Medium
- suitecrmSuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure7.7 High
- goposta postaPosta before v0.18.0 SSRF via Webhook URL5.3 Medium
- jarun bukubuku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API6.3 Medium
- suitecrmSuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services7.7 High
- suitecrmSuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron7.1 High
- sensiolabs symfonySymfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass6.3 Medium
- trellix dlp on-prem extensionsServer side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1...5.3 Medium
- apache software foundation ofbizApache OFBiz: Server-side request forgery in SurveyWrapper8.1 High
- apache ofbizApache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile4.3 Medium
- sensiolabs symfonySymfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)2.3 Low
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import5.0 Medium
- webminWebmin: SSRF exploit in Upload and Download and File Manager modules4.9 Medium
- readestReadest: Unauthenticated SSRF / open request proxy in /api/opds/proxy9.3 Critical
- jgraph drawiodraw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts5.8 Medium
- germondai trawlTrawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass6.3 Medium
- Show moreLoading…