CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-92X5-9Q2R-X8GQ
Vulnerability from github – Published: 2024-03-01 00:30 – Updated: 2024-03-01 00:30Recipes version 1.5.10 allows arbitrary HTTP requests to be made
through the server. This is possible because the application is
vulnerable to SSRF.
{
"affected": [],
"aliases": [
"CVE-2024-0403"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T00:15:51Z",
"severity": "MODERATE"
},
"details": "Recipes version 1.5.10 allows arbitrary HTTP requests to be made\n\nthrough the server. This is possible because the application is\n\nvulnerable to SSRF.\n\n\n\n\n",
"id": "GHSA-92x5-9q2r-x8gq",
"modified": "2024-03-01T00:30:28Z",
"published": "2024-03-01T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0403"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/harris"
},
{
"type": "WEB",
"url": "https://github.com/TandoorRecipes/recipes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9389-GQ7V-6FH7
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.
{
"affected": [],
"aliases": [
"CVE-2021-3204"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-19T14:15:00Z",
"severity": "MODERATE"
},
"details": "SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.",
"id": "GHSA-9389-gq7v-6fh7",
"modified": "2022-05-24T17:42:42Z",
"published": "2022-05-24T17:42:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3204"
},
{
"type": "WEB",
"url": "https://www.l0l.xyz/sec/2021/01/05/1-webdesktop-root-ssrf.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-939C-3G97-VPVV
Vulnerability from github – Published: 2023-04-26 00:30 – Updated: 2025-02-04 21:22Withdrawn Advisory
This advisory has been withdrawn because it was determined to be a configuration issue rather than a vulnerability. This link is maintained to preserve external references. For more information, see the conversation here.
Original Advisory
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/prometheus/blackbox_exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26735"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-26T15:56:45Z",
"nvd_published_at": "2023-04-26T00:15:09Z",
"severity": "HIGH"
},
"details": "# Withdrawn Advisory\nThis advisory has been withdrawn because it was determined to be a configuration issue rather than a vulnerability. This link is maintained to preserve external references. For more information, see the conversation [here](https://github.com/prometheus/blackbox_exporter/issues/1024#issuecomment-1449145854).\n\n# Original Advisory\nblackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.",
"id": "GHSA-939c-3g97-vpvv",
"modified": "2025-02-04T21:22:40Z",
"published": "2023-04-26T00:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26735"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/blackbox_exporter/issues/1024"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/blackbox_exporter/issues/1025"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/blackbox_exporter/issues/1026"
},
{
"type": "PACKAGE",
"url": "https://github.com/prometheus/blackbox_exporter"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication"
},
{
"type": "WEB",
"url": "http://blackboxexporter.com"
},
{
"type": "WEB",
"url": "http://prometheus.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Withdrawn Advisory: Access control issues in blackbox_exporter",
"withdrawn": "2025-02-04T21:22:40Z"
}
GHSA-93F7-RF7F-3GPW
Vulnerability from github – Published: 2025-09-14 09:30 – Updated: 2025-09-14 09:30A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.
{
"affected": [],
"aliases": [
"CVE-2025-10395"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-14T08:15:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.",
"id": "GHSA-93f7-rf7f-3gpw",
"modified": "2025-09-14T09:30:23Z",
"published": "2025-09-14T09:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10395"
},
{
"type": "WEB",
"url": "https://github.com/August829/Yu/blob/main/58ead8e7e08bfb017.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323830"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323830"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.645798"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-93FV-4PM9-XP28
Vulnerability from github – Published: 2025-12-09 17:23 – Updated: 2025-12-09 17:23Impact
Anyone using untrusted message components may be affected. On versions >=6.0.0,<6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.
If you are used Message#getComponents or similar to get a list of components and then send those components with sendMessageComponents or other methods, you might unintentionally download media from an external URL in the resolved media of a Thumbnail, FileDisplay, or MediaGallery.
Patches
This bug has been fixed in 6.1.3, and we recommend updating.
Workarounds
Avoid sending components from untrusted messages or update to version 6.1.3.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.dv8tion:JDA"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-09T17:23:54Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nAnyone using untrusted message components may be affected. On versions \u003e=6.0.0,\u003c6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.\n\nIf you are used `Message#getComponents` or similar to get a list of components and then send those components with `sendMessageComponents` or other methods, you might unintentionally download media from an external URL in the resolved media of a `Thumbnail`, `FileDisplay`, or `MediaGallery`.\n\n### Patches\n\nThis bug has been fixed in 6.1.3, and we recommend updating.\n\n### Workarounds\n\nAvoid sending components from untrusted messages or update to version 6.1.3.",
"id": "GHSA-93fv-4pm9-xp28",
"modified": "2025-12-09T17:23:54Z",
"published": "2025-12-09T17:23:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/discord-jda/JDA/security/advisories/GHSA-93fv-4pm9-xp28"
},
{
"type": "WEB",
"url": "https://github.com/discord-jda/JDA/commit/bb6d2ce5cf514429327c257f5c6fa95a137e3ab6"
},
{
"type": "PACKAGE",
"url": "https://github.com/discord-jda/JDA"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "JDA (Java Discord API) downloads external URLs when updating message components"
}
GHSA-93HQ-MR64-XH85
Vulnerability from github – Published: 2024-01-24 12:30 – Updated: 2026-04-28 21:33Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
{
"affected": [],
"aliases": [
"CVE-2024-22134"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-24T12:15:57Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.",
"id": "GHSA-93hq-mr64-xh85",
"modified": "2026-04-28T21:33:51Z",
"published": "2024-01-24T12:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22134"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-93V3-46MJ-22FW
Vulnerability from github – Published: 2025-12-31 06:30 – Updated: 2025-12-31 06:30A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".
{
"affected": [],
"aliases": [
"CVE-2025-15373"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-31T04:15:53Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor is \"[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8\".",
"id": "GHSA-93v3-46mj-22fw",
"modified": "2025-12-31T06:30:17Z",
"published": "2025-12-31T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15373"
},
{
"type": "WEB",
"url": "https://note-hxlab.wetolink.com/share/DeUFyoSjsPPK"
},
{
"type": "WEB",
"url": "https://note-hxlab.wetolink.com/share/DeUFyoSjsPPK#-span--strong-proof-of-concept---strong---span-"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.339081"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.339081"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.718465"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-93X8-66J2-WWR5
Vulnerability from github – Published: 2024-02-17 06:30 – Updated: 2024-08-02 10:39All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21498"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:53:06Z",
"nvd_published_at": "2024-02-17T05:15:10Z",
"severity": "MODERATE"
},
"details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.",
"id": "GHSA-93x8-66j2-wwr5",
"modified": "2024-08-02T10:39:31Z",
"published": "2024-02-17T06:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21498"
},
{
"type": "WEB",
"url": "https://github.com/greenpau/caddy-security/issues/269"
},
{
"type": "WEB",
"url": "https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249862"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Server-Side Request Forgery in github.com/greenpau/caddy-security"
}
GHSA-9426-VXHJ-RXM5
Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2024-08-27 21:31An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution.
{
"affected": [],
"aliases": [
"CVE-2022-34269"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:35:13Z",
"severity": "HIGH"
},
"details": "An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution.",
"id": "GHSA-9426-vxhj-rxm5",
"modified": "2024-08-27T21:31:10Z",
"published": "2024-02-29T03:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34269"
},
{
"type": "WEB",
"url": "https://www.rws.com/localization/products/trados-enterprise/worldserver"
},
{
"type": "WEB",
"url": "https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-943P-QF6Q-5M99
Vulnerability from github – Published: 2022-05-17 03:35 – Updated: 2022-05-17 03:35The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.
{
"affected": [],
"aliases": [
"CVE-2016-7964"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-31T10:59:00Z",
"severity": "HIGH"
},
"details": "The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.",
"id": "GHSA-943p-qf6q-5m99",
"modified": "2022-05-17T03:35:09Z",
"published": "2022-05-17T03:35:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7964"
},
{
"type": "WEB",
"url": "https://github.com/splitbrain/dokuwiki/issues/1708"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94245"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.