CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4757 vulnerabilities reference this CWE, most recent first.
GHSA-CMX4-P4V5-HMR5
Vulnerability from github – Published: 2022-02-09 00:46 – Updated: 2022-02-08 22:03Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.xmlgraphics:batik"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-17566"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-31T20:43:02Z",
"nvd_published_at": "2020-11-12T18:15:00Z",
"severity": "HIGH"
},
"details": "Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.",
"id": "GHSA-cmx4-p4v5-hmr5",
"modified": "2022-02-08T22:03:08Z",
"published": "2022-02-09T00:46:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17566"
},
{
"type": "WEB",
"url": "https://github.com/apache/xmlgraphics-batik/commit/bc6078ca949039e2076cd08b4cb169c84c1179b1"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/xmlgraphics-batik"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/BATIK-1276"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171%40%3Ccommits.myfaces.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171@%3Ccommits.myfaces.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509%40%3Ccommits.myfaces.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509@%3Ccommits.myfaces.apache.org%3E"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-11"
},
{
"type": "WEB",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "https://xmlgraphics.apache.org/security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-side request forgery (SSRF) in Apache Batik"
}
GHSA-CP3Q-Q6MX-W79J
Vulnerability from github – Published: 2023-08-02 15:30 – Updated: 2024-01-12 09:30External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2023-26438"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-02T13:15:10Z",
"severity": "LOW"
},
"details": "External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.\n\n",
"id": "GHSA-cp3q-q6mx-w79j",
"modified": "2024-01-12T09:30:27Z",
"published": "2023-08-02T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26438"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0003.json"
},
{
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Aug/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CP5F-3367-9VFC
Vulnerability from github – Published: 2022-05-13 01:45 – Updated: 2025-04-20 03:36Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2017-3546"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-24T19:59:00Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"id": "GHSA-cp5f-3367-9vfc",
"modified": "2025-04-20T03:36:44Z",
"published": "2022-05-13T01:45:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3546"
},
{
"type": "WEB",
"url": "https://erpscan.io/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42034"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97872"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPF6-Q438-6GRJ
Vulnerability from github – Published: 2022-12-19 21:30 – Updated: 2022-12-23 21:30IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.
{
"affected": [],
"aliases": [
"CVE-2022-38708"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T21:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.",
"id": "GHSA-cpf6-q438-6grj",
"modified": "2022-12-23T21:30:17Z",
"published": "2022-12-19T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38708"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/234180"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6841801"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPGJ-F7G3-2PP2
Vulnerability from github – Published: 2026-06-16 19:02 – Updated: 2026-07-20 21:01Summary
When fetch() was called, Deno checked the destination hostname against
--deny-net rules but did not re-check the IP addresses that hostname
resolved to. An attacker-controlled script could use a specially crafted domain
name that passes the hostname check yet resolves to a denied IP, bypassing the
network restriction entirely.
Impact
Code running under --deny-net could reach hosts that the user intended to
block. In practice this means network isolation rules — for example, blocking
access to localhost or internal services — could be silently circumvented by
a malicious or compromised dependency.
A companion advisory covers the same class of issue in the WebSocket API.
Who is affected
Users who:
- run untrusted or third-party code with
deno run, and - rely on
--deny-netto restrict which hosts that code can reach.
If you do not use --deny-net, or if you only run fully trusted code, you are
not affected.
Workaround
No workaround is available short of upgrading. If upgrading immediately is not
possible, avoid granting --allow-net to untrusted code that also has
--deny-net restrictions you depend on for security.
Fix
The fetch() DNS resolver now performs a post-resolution check on every IP
address before passing it to the HTTP connector, consistent with how
Deno.connect already behaved.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.0"
},
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49859"
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-16T19:02:55Z",
"nvd_published_at": "2026-06-23T18:18:03Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nWhen `fetch()` was called, Deno checked the destination hostname against\n`--deny-net` rules but did not re-check the IP addresses that hostname\nresolved to. An attacker-controlled script could use a specially crafted domain\nname that passes the hostname check yet resolves to a denied IP, bypassing the\nnetwork restriction entirely.\n\n## Impact\n\nCode running under `--deny-net` could reach hosts that the user intended to\nblock. In practice this means network isolation rules \u2014 for example, blocking\naccess to `localhost` or internal services \u2014 could be silently circumvented by\na malicious or compromised dependency.\n\nA companion advisory covers the same class of issue in the WebSocket API.\n\n## Who is affected\n\nUsers who:\n\n- run untrusted or third-party code with `deno run`, and\n- rely on `--deny-net` to restrict which hosts that code can reach.\n\nIf you do not use `--deny-net`, or if you only run fully trusted code, you are\nnot affected.\n\n## Workaround\n\nNo workaround is available short of upgrading. If upgrading immediately is not\npossible, avoid granting `--allow-net` to untrusted code that also has\n`--deny-net` restrictions you depend on for security.\n\n## Fix\n\nThe `fetch()` DNS resolver now performs a post-resolution check on every IP\naddress before passing it to the HTTP connector, consistent with how\n`Deno.connect` already behaved.",
"id": "GHSA-cpgj-f7g3-2pp2",
"modified": "2026-07-20T21:01:14Z",
"published": "2026-06-16T19:02:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49859"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Deno: `fetch()` API sandbox bypass via missing DNS resolution check"
}
GHSA-CPJV-5WWH-MWG5
Vulnerability from github – Published: 2025-05-07 15:31 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress allows Server Side Request Forgery. This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through 1.4.4.
{
"affected": [],
"aliases": [
"CVE-2025-47548"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T15:16:11Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress allows Server Side Request Forgery. This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through 1.4.4.",
"id": "GHSA-cpjv-5wwh-mwg5",
"modified": "2026-04-01T18:35:03Z",
"published": "2025-05-07T15:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47548"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/activity-link-preview-for-buddypress/vulnerability/wordpress-wbcom-designs-activity-link-preview-for-buddypress-1-4-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPPX-6F25-3QXC
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as read_csv, read_csv_auto, read_text, and read_blob, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks.
{
"affected": [],
"aliases": [
"CVE-2024-8099"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:41Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB\u0027s default features, such as `read_csv`, `read_csv_auto`, `read_text`, and `read_blob`, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks.",
"id": "GHSA-cppx-6f25-3qxc",
"modified": "2025-03-20T12:32:47Z",
"published": "2025-03-20T12:32:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8099"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/19b96694-ed52-4ee4-8d2c-6cc7bd09c0ad"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-CQ2X-934M-8P64
Vulnerability from github – Published: 2024-03-12 15:32 – Updated: 2025-07-25 18:30Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP.
{
"affected": [],
"aliases": [
"CVE-2024-2049"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T13:15:49Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP.",
"id": "GHSA-cq2x-934m-8p64",
"modified": "2025-07-25T18:30:32Z",
"published": "2024-03-12T15:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2049"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049"
},
{
"type": "WEB",
"url": "https://support.citrix.com/external/article?articleUrl=CTX617071-citrix-sdwan-security-bulletin-for-cve20242049\u0026language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQ38-9F6P-96J8
Vulnerability from github – Published: 2022-11-21 15:30 – Updated: 2022-11-23 18:30Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
{
"affected": [],
"aliases": [
"CVE-2022-4096"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-21T15:15:00Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.",
"id": "GHSA-cq38-9f6p-96j8",
"modified": "2022-11-23T18:30:28Z",
"published": "2022-11-21T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4096"
},
{
"type": "WEB",
"url": "https://github.com/appsmithorg/appsmith/commit/769719ccfe667f059fe0b107a19ec9feb90f2e40"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/7969e834-5982-456e-9683-861a7a5e2d22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQ56-W8H5-CWCJ
Vulnerability from github – Published: 2022-05-14 02:20 – Updated: 2022-05-14 02:20An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.
{
"affected": [],
"aliases": [
"CVE-2016-4046"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-15T06:59:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.",
"id": "GHSA-cq56-w8h5-cwcj",
"modified": "2022-05-14T02:20:11Z",
"published": "2022-05-14T02:20:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4046"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/538732/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036157"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.