Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4758 vulnerabilities reference this CWE, most recent first.
GHSA-F7FH-QG34-X2XH
Vulnerability from github – Published: 2026-04-17 22:18 – Updated: 2026-05-12 13:34
VLAI
Summary
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets
Details
Summary
CDP /json/version WebSocket URL could pivot to untrusted second-hop targets.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.5 - Patched versions:
>= 2026.4.5
Impact
A browser profile could trust a CDP /json/version response whose webSocketDebuggerUrl pointed at a different host, enabling a second-hop SSRF-style pivot.
Technical Details
The fix normalizes and re-validates direct CDP WebSocket targets before connecting.
Fix
The issue was fixed in #60469. The first stable tag containing the fix is v2026.4.5, and openclaw@2026.4.14 includes the fix.
Fix Commit(s)
bc356cc8c2beaa747c71dd86cceab8f804699665- PR: #60469
Release Process Note
Users should upgrade to openclaw 2026.4.5 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @tdjackey for reporting this issue.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43576"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-17T22:18:28Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nCDP /json/version WebSocket URL could pivot to untrusted second-hop targets.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.5`\n- Patched versions: `\u003e= 2026.4.5`\n\n## Impact\n\nA browser profile could trust a CDP `/json/version` response whose `webSocketDebuggerUrl` pointed at a different host, enabling a second-hop SSRF-style pivot.\n\n## Technical Details\n\nThe fix normalizes and re-validates direct CDP WebSocket targets before connecting.\n\n## Fix\n\nThe issue was fixed in #60469. The first stable tag containing the fix is `v2026.4.5`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `bc356cc8c2beaa747c71dd86cceab8f804699665`\n- PR: #60469\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.5 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @tdjackey for reporting this issue.",
"id": "GHSA-f7fh-qg34-x2xh",
"modified": "2026-05-12T13:34:48Z",
"published": "2026-04-17T22:18:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-f7fh-qg34-x2xh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43576"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/pull/60469"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/bc356cc8c2beaa747c71dd86cceab8f804699665"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-second-hop-ssrf-via-cdp-json-version-websocket-url"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets"
}
GHSA-F7FP-X9MV-9JHH
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2026-04-01 18:35
VLAI
Details
Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress allows Server Side Request Forgery. This issue affects FG Drupal to WordPress: from n/a through 3.90.0.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48294"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-16T11:15:25Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress allows Server Side Request Forgery. This issue affects FG Drupal to WordPress: from n/a through 3.90.0.",
"id": "GHSA-f7fp-x9mv-9jhh",
"modified": "2026-04-01T18:35:46Z",
"published": "2025-07-16T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48294"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/fg-drupal-to-wp/vulnerability/wordpress-fg-drupal-to-wordpress-plugin-3-90-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F7GX-8WV8-8WM9
Vulnerability from github – Published: 2026-07-03 00:31 – Updated: 2026-07-03 00:31
VLAI
Details
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
Severity
9.9 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-45499"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T23:16:51Z",
"severity": "CRITICAL"
},
"details": "Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-f7gx-8wv8-8wm9",
"modified": "2026-07-03T00:31:53Z",
"published": "2026-07-03T00:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45499"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F7H5-C625-3795
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2025-07-18 17:45
VLAI
Summary
Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
Details
In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.glassfish.main.admingui:console-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-9408"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-18T17:45:26Z",
"nvd_published_at": "2025-07-16T12:15:23Z",
"severity": "HIGH"
},
"details": "In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.",
"id": "GHSA-f7h5-c625-3795",
"modified": "2025-07-18T17:45:26Z",
"published": "2025-07-16T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9408"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse-ee4j/glassfish"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/38"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints"
}
GHSA-F7QG-XJ45-W956
Vulnerability from github – Published: 2025-09-15 20:31 – Updated: 2025-09-22 15:49
VLAI
Summary
Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark
Details
Impact
A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.
Vulnerable versions
This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.
Patches
v5.130.4 and v6.0.9 contain a fix for this issue.
References
The original report is available here: https://fluidattacks.com/advisories/regida
We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.8"
},
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.130.3"
},
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "5.99.0"
},
{
"fixed": "5.130.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-9862"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T20:31:14Z",
"nvd_published_at": "2025-09-17T15:15:43Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA vulnerability in Ghost\u0027s oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.\n\n### Patches\n\nv5.130.4 and v6.0.9 contain a fix for this issue.\n\n### References\n\nThe original report is available here: https://fluidattacks.com/advisories/regida\n\nWe thank Cristian Vargas for discovering and disclosing this vulnerability responsibly. \n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).",
"id": "GHSA-f7qg-xj45-w956",
"modified": "2025-09-22T15:49:29Z",
"published": "2025-09-15T20:31:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9862"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/commit/01d64c7c0ffbf90cd036195c60ded6d08077d612"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/commit/ffe9d079afa68557c581d224f1ff126e625b06e3"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/regida"
},
{
"type": "PACKAGE",
"url": "https://github.com/TryGhost/Ghost"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/releases/tag/v6.0.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark"
}
GHSA-F7RM-PM4C-W834
Vulnerability from github – Published: 2025-08-15 18:31 – Updated: 2025-08-15 18:31
VLAI
Details
Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-8675"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-15T17:15:33Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.",
"id": "GHSA-f7rm-pm4c-w834",
"modified": "2025-08-15T18:31:12Z",
"published": "2025-08-15T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8675"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2025-095"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8HV-G549-HWG2
Vulnerability from github – Published: 2026-04-16 20:45 – Updated: 2026-06-08 19:54
VLAI
Summary
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Details
Impact
The webhook add-on did not utilize existing SSRF protection.
Patches
- https://github.com/WeblateOrg/weblate/pull/18815
Workarounds
Disabling the add-on would avoid misusing this.
References
Thanks to @Lihfdgjr for reporting this via GitHub.
Severity
4.1 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Weblate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39845"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T20:45:04Z",
"nvd_published_at": "2026-04-15T19:16:36Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe webhook add-on did not utilize existing SSRF protection.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/18815\n\n### Workarounds\nDisabling the add-on would avoid misusing this.\n\n### References\nThanks to @Lihfdgjr for reporting this via GitHub.",
"id": "GHSA-f8hv-g549-hwg2",
"modified": "2026-06-08T19:54:41Z",
"published": "2026-04-16T20:45:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-f8hv-g549-hwg2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39845"
},
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/weblate/pull/18815"
},
{
"type": "PACKAGE",
"url": "https://github.com/WeblateOrg/weblate"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-156.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Weblate: SSRF via the webhook add-on using unprotected fetch_url()"
}
GHSA-F8JX-JHWH-GQ9J
Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2024-04-04 02:02
VLAI
Details
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2019-16932"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-30T16:15:00Z",
"severity": "CRITICAL"
},
"details": "A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.",
"id": "GHSA-f8jx-jhwh-gq9j",
"modified": "2024-04-04T02:02:11Z",
"published": "2022-05-24T16:57:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16932"
},
{
"type": "WEB",
"url": "https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/visualizer/#developers"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9892"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8R7-7HV9-7F43
Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2022-12-12 16:34
VLAI
Summary
Jenkins CAS Plugin Server-Side Request Forgery vulnerability
Details
A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 1.4.2, this form validation method requires POST requests and the Overall/Administer permission.
Severity
5.4 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:cas-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000188"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T16:34:18Z",
"nvd_published_at": "2018-06-05T20:29:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 1.4.2, this form validation method requires POST requests and the Overall/Administer permission.",
"id": "GHSA-f8r7-7hv9-7f43",
"modified": "2022-12-12T16:34:18Z",
"published": "2022-05-14T03:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000188"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/cas-plugin/commit/25d952151d61dec3627e875f03ac4f648d5e883d"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/cas-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-06-04/#SECURITY-809"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins CAS Plugin Server-Side Request Forgery vulnerability"
}
GHSA-F8VW-8VGH-22R9
Vulnerability from github – Published: 2025-07-18 15:31 – Updated: 2025-09-13 04:43
VLAI
Summary
XXL-JOB is vulnerable to SSRF attacks
Details
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.xuxueli:xxl-job-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-7787"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-21T12:26:33Z",
"nvd_published_at": "2025-07-18T15:15:31Z",
"severity": "LOW"
},
"details": "A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\\main\\java\\com\\xxl\\job\\executor\\service\\jobhandler\\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-f8vw-8vgh-22r9",
"modified": "2025-09-13T04:43:42Z",
"published": "2025-07-18T15:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7787"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3749"
},
{
"type": "PACKAGE",
"url": "https://github.com/xuxueli/xxl-job"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.316848"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.316848"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.615741"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "XXL-JOB is vulnerable to SSRF attacks"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.