Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4736 vulnerabilities reference this CWE, most recent first.

GHSA-82RV-H33P-2XGC

Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2024-03-27 15:30
VLAI
Details

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/. This flawcan be used to circumvent filters, checks and more.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-27780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-177",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-02T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "The curl URL parser wrongly accepts percent-encoded URL separators like \u0027/\u0027when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.",
  "id": "GHSA-82rv-h33p-2xgc",
  "modified": "2024-03-27T15:30:35Z",
  "published": "2022-06-03T00:01:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27780"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1553841"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202212-01"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220609-0009"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-836C-XG97-8P4H

Vulnerability from github – Published: 2021-04-30 17:34 – Updated: 2024-09-27 21:39
VLAI
Summary
libtaxii Server-Side Request Forgery vulnerability
Details

"TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.""

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "libtaxii"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.118"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-27197"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-20T17:53:43Z",
    "nvd_published_at": "2020-10-17T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "\"TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method \"wraps the lxml library\" and that this may be an issue to \"raise ... to the lxml group.\"\"",
  "id": "GHSA-836c-xg97-8p4h",
  "modified": "2024-09-27T21:39:29Z",
  "published": "2021-04-30T17:34:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27197"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TAXIIProject/libtaxii/issues/246"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclecticiq/OpenTAXII/issues/176"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TAXIIProject/libtaxii/pull/247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TAXIIProject/libtaxii/commit/23c6f7b69d99e965c8d53dc4710ae64da3fb4842"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TAXIIProject/libtaxii"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-836c-xg97-8p4h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/libtaxii/PYSEC-2020-59.yaml"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/159662/Libtaxii-1.1.117-OpenTaxi-0.2.0-Server-Side-Request-Forgery.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "libtaxii Server-Side Request Forgery vulnerability"
}

GHSA-83JG-M2PM-4JXJ

Vulnerability from github – Published: 2025-12-20 17:42 – Updated: 2026-01-14 14:29
VLAI
Summary
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Details

Summary

A Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.

Details

When Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The wget and curl command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.

An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.

This vulnerability was observed being actively exploited in the wild.

Acknowledgements This vulnerability was investigated by Abraham Gebrehiwot and Filippo Lauria, with additional contributions from Michele Castellaneta, Claudio Porta and Sara Afzal. All researchers are affiliated with the Institute of Informatics and Telematics (IIT), Italian National Research Council (CNR).

Fix This issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as wget and curl.

PoC

This is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability.

Setup: - Victim machine (192.168.1.30): runs a simple HTTP server - Attacker machine (192.168.1.20): initiates the attack - Cowrie honeypot (192.168.1.10): configured in emulated shell mode with SSH access (credentials: test:test)

On the victim machine, start an HTTP server:

sudo python3 -m http.server 80

On the attacker machine, execute:

PAYLOAD=$(for i in {1..100}; do echo -n 'wget -q http://192.168.1.30;'; done) && \
for i in {1..10}; do sshpass -p test ssh test@192.168.1.10 "$PAYLOAD"; done

This command builds a PAYLOAD consisting of 100 concatenated wget commands, then executes it 10 times via SSH, resulting in 1,000 HTTP requests toward the victim from a single attack script. The amplification factor can be arbitrarily increased by adjusting these values, bounded by technical limitations such as argument length, buffer sizes, etc.

Result: The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity):

192.168.1.10 - - [11/Dec/2025 14:33:03] "GET / HTTP/1.1" 200 -
192.168.1.10 - - [11/Dec/2025 14:33:03] "GET / HTTP/1.1" 200 -
192.168.1.10 - - [11/Dec/2025 14:33:03] "GET / HTTP/1.1" 200 -
...
192.168.1.10 - - [11/Dec/2025 14:33:08] "GET / HTTP/1.1" 200 -
192.168.1.10 - - [11/Dec/2025 14:33:08] "GET / HTTP/1.1" 200 -
192.168.1.10 - - [11/Dec/2025 14:33:08] "GET / HTTP/1.1" 200 -

Notice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity.

Impact

This is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes.

Who is impacted: Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0.

Consequences: - Third-party victims receive unwanted HTTP traffic from the honeypot's IP address - Attackers can mask their identity behind the honeypot's IP - Honeypot operators may face abuse complaints or have their infrastructure blocklisted - Network resources of the honeypot host are consumed

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cowrie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-34469"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-20T17:42:07Z",
    "nvd_published_at": "2025-12-31T22:15:49Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability in Cowrie\u0027s emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.\n\n### Details\n\nWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The `wget` and `curl` command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.\n\nAn attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot\u0027s IP address, effectively masking the attacker\u0027s identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.\n\nThis vulnerability was observed being actively exploited in the wild.\n\n**Acknowledgements**\nThis vulnerability was investigated by _[Abraham Gebrehiwot](https://www.iit.cnr.it/en/abraham.gebrehiwot/)_ and _Filippo Lauria_, with additional contributions from _Michele Castellaneta_, _Claudio Porta_ and _Sara Afzal_. All researchers are affiliated with the [Institute of Informatics and Telematics](https://www.iit.cnr.it/en/) (IIT),  [Italian National Research Council](https://www.cnr.it/en/) (CNR).\n\n**Fix**\nThis issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as `wget` and `curl`.\n\n### PoC\n\nThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability.\n\n**Setup:**\n- Victim machine (192.168.1.30): runs a simple HTTP server\n- Attacker machine (192.168.1.20): initiates the attack\n- Cowrie honeypot (192.168.1.10): configured in emulated shell mode with SSH access (credentials: `test:test`)\n\n**On the victim machine**, start an HTTP server:\n```bash\nsudo python3 -m http.server 80\n```\n\n**On the attacker machine**, execute:\n```bash\nPAYLOAD=$(for i in {1..100}; do echo -n \u0027wget -q http://192.168.1.30;\u0027; done) \u0026\u0026 \\\nfor i in {1..10}; do sshpass -p test ssh test@192.168.1.10 \"$PAYLOAD\"; done\n```\n\nThis command builds a `PAYLOAD` consisting of 100 concatenated `wget` commands, then executes it 10 times via SSH, resulting in 1,000 HTTP requests toward the victim from a single attack script. The amplification factor can be arbitrarily increased by adjusting these values, bounded by technical limitations such as argument length, buffer sizes, etc.\n\n**Result:** The victim\u0027s HTTP server logs show 1,000 requests originating exclusively from the honeypot\u0027s IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity):\n```\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:03] \"GET / HTTP/1.1\" 200 -\n...\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n192.168.1.10 - - [11/Dec/2025 14:33:08] \"GET / HTTP/1.1\" 200 -\n```\n\nNotice that the attacker\u0027s IP (192.168.1.20) never appears in the victim\u0027s logs, demonstrating how the honeypot masks the attacker\u0027s identity.\n\n### Impact\n\nThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes.\n\n**Who is impacted:** Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0.\n\n**Consequences:**\n- Third-party victims receive unwanted HTTP traffic from the honeypot\u0027s IP address\n- Attackers can mask their identity behind the honeypot\u0027s IP\n- Honeypot operators may face abuse complaints or have their infrastructure blocklisted\n- Network resources of the honeypot host are consumed",
  "id": "GHSA-83jg-m2pm-4jxj",
  "modified": "2026-01-14T14:29:45Z",
  "published": "2025-12-20T17:42:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cowrie/cowrie/security/advisories/GHSA-83jg-m2pm-4jxj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cowrie/cowrie/issues/2622"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cowrie/cowrie/pull/2800"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-83jg-m2pm-4jxj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cowrie/cowrie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cowrie/cowrie/releases/tag/v2.9.0"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/cverecord?id=CVE-2025-34469"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/cowrie-unrestricted-wget-curl-emulation-enables-ssrf-based-ddos-amplification"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification"
}

GHSA-83PC-3RW9-QPWJ

Vulnerability from github – Published: 2026-06-16 19:04 – Updated: 2026-07-20 21:01
VLAI
Summary
Deno: WebSocket API sandbox bypass via missing post-DNS check
Details

Summary

When a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely.

Impact

Code running under --deny-net could connect to hosts that the user intended to block. In practice this means network isolation rules — for example, blocking access to localhost or internal services — could be silently circumvented by a malicious or compromised dependency.

Deno.connect and fetch() were not affected by this specific issue (a companion advisory covers fetch()).

Who is affected

Users who:

  • run untrusted or third-party code with deno run, and
  • rely on --deny-net to restrict which hosts that code can reach.

If you do not use --deny-net, or if you only run fully trusted code, you are not affected.

Workaround

No workaround is available short of upgrading. If upgrading immediately is not possible, avoid granting --allow-net to untrusted code that also has --deny-net restrictions you depend on for security.

Severity
5.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.0"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "deno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49860"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T19:04:07Z",
    "nvd_published_at": "2026-06-23T18:18:04Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen a WebSocket connection was opened, Deno checked the destination hostname\nagainst `--deny-net` rules but did not re-check the IP addresses that hostname\nresolved to. An attacker-controlled script could use a specially crafted domain\nname that passes the hostname check yet resolves to a denied IP, bypassing the\nnetwork restriction entirely.\n\n## Impact\n\nCode running under `--deny-net` could connect to hosts that the user intended\nto block. In practice this means network isolation rules \u2014 for example,\nblocking access to `localhost` or internal services \u2014 could be silently\ncircumvented by a malicious or compromised dependency.\n\n`Deno.connect` and `fetch()` were not affected by this specific issue (a\ncompanion advisory covers `fetch()`).\n\n## Who is affected\n\nUsers who:\n\n- run untrusted or third-party code with `deno run`, and\n- rely on `--deny-net` to restrict which hosts that code can reach.\n\nIf you do not use `--deny-net`, or if you only run fully trusted code, you are\nnot affected.\n\n## Workaround\n\nNo workaround is available short of upgrading. If upgrading immediately is not\npossible, avoid granting `--allow-net` to untrusted code that also has\n`--deny-net` restrictions you depend on for security.",
  "id": "GHSA-83pc-3rw9-qpwj",
  "modified": "2026-07-20T21:01:04Z",
  "published": "2026-06-16T19:04:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49860"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/denoland/deno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deno: WebSocket API sandbox bypass via missing post-DNS check"
}

GHSA-83VX-XM77-C4MM

Vulnerability from github – Published: 2023-02-12 06:30 – Updated: 2026-05-18 18:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery.This issue affects Smartpower Web: before 23.01.01.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-45085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-12T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery.This issue affects Smartpower Web: before 23.01.01.",
  "id": "GHSA-83vx-xm77-c4mm",
  "modified": "2026-05-18T18:31:22Z",
  "published": "2023-02-12T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45085"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0066"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-23-0066"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-83W4-X5W9-HF4H

Vulnerability from github – Published: 2022-11-17 21:30 – Updated: 2025-07-18 18:04
VLAI
Summary
XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)
Details

XXL-Job before v2.4.0 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.xuxueli:xxl-job-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-43183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T22:33:41Z",
    "nvd_published_at": "2022-11-17T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "XXL-Job before v2.4.0 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.",
  "id": "GHSA-83w4-x5w9-hf4h",
  "modified": "2025-07-18T18:04:13Z",
  "published": "2022-11-17T21:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43183"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/issues/3002"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/commit/9293c61ca0a8d54afdfb27cc568885ae639a14dc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xuxueli/xxl-job"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/releases/tag/2.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)"
}

GHSA-8425-76GW-QXJ4

Vulnerability from github – Published: 2026-02-18 09:31 – Updated: 2026-02-18 09:31
VLAI
Details

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the endpoint parameter in the get_items() function of the GetResponse REST API handler. The endpoint's permission check only requires edit_posts capability (Contributor role) rather than manage_options (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. The stored API key is also leaked in the request headers.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-1857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T07:16:09Z",
    "severity": "MODERATE"
  },
  "details": "The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint\u0027s permission check only requires `edit_posts` capability (Contributor role) rather than `manage_options` (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site\u0027s stored API credentials. The stored API key is also leaked in the request headers.",
  "id": "GHSA-8425-76gw-qxj4",
  "modified": "2026-02-18T09:31:03Z",
  "published": "2026-02-18T09:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1857"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L57"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L77"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3454881%40kadence-blocks%2Ftrunk\u0026old=3453204%40kadence-blocks%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea8d38a-f5ce-40dd-a015-f56d60579e05?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-843J-35Q9-6F9X

Vulnerability from github – Published: 2025-04-09 18:30 – Updated: 2026-04-01 18:34
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help allows Server Side Request Forgery. This issue affects SEO Help: from n/a through 6.6.0.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-32675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-09T17:15:51Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help allows Server Side Request Forgery. This issue affects SEO Help: from n/a through 6.6.0.",
  "id": "GHSA-843j-35q9-6f9x",
  "modified": "2026-04-01T18:34:38Z",
  "published": "2025-04-09T18:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32675"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/seo-help/vulnerability/wordpress-seo-help-plugin-6-6-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8489-VWCJ-FXFR

Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2025-10-22 00:32
VLAI
Details

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22986"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-31T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.",
  "id": "GHSA-8489-vwcj-fxfr",
  "modified": "2025-10-22T00:32:05Z",
  "published": "2022-05-24T17:45:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22986"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K03009991"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22986"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-84C3-765R-7FJP

Vulnerability from github – Published: 2024-10-30 21:30 – Updated: 2024-10-31 18:31
VLAI
Details

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-51242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-30T21:15:14Z",
    "severity": "MODERATE"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.",
  "id": "GHSA-84c3-765r-7fjp",
  "modified": "2024-10-31T18:31:18Z",
  "published": "2024-10-30T21:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shadia0/Patienc/blob/main/eladmin_ssrf.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list