CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4739 vulnerabilities reference this CWE, most recent first.
GHSA-HHRV-84GM-4Q6X
Vulnerability from github – Published: 2024-08-15 18:31 – Updated: 2024-09-11 15:31A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on.
{
"affected": [],
"aliases": [
"CVE-2024-22217"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T18:15:19Z",
"severity": "MODERATE"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on.",
"id": "GHSA-hhrv-84gm-4q6x",
"modified": "2024-09-11T15:31:11Z",
"published": "2024-08-15T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22217"
},
{
"type": "WEB",
"url": "https://docs.terminalfour.com/articles/release-notes-highlights"
},
{
"type": "WEB",
"url": "https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22217"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HHVH-F9M6-HQ8F
Vulnerability from github – Published: 2023-04-15 03:30 – Updated: 2024-04-04 03:29OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
{
"affected": [],
"aliases": [
"CVE-2022-43698"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-15T02:15:00Z",
"severity": "MODERATE"
},
"details": "OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.",
"id": "GHSA-hhvh-f9m6-hq8f",
"modified": "2024-04-04T03:29:01Z",
"published": "2023-04-15T03:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43698"
},
{
"type": "WEB",
"url": "https://open-xchange.com"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2023/Feb/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HHWP-8MHP-W9RV
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.
{
"affected": [],
"aliases": [
"CVE-2020-15297"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-09T09:15:00Z",
"severity": "CRITICAL"
},
"details": "Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.",
"id": "GHSA-hhwp-8mhp-w9rv",
"modified": "2022-05-24T17:33:37Z",
"published": "2022-05-24T17:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15297"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-bitdefender-update-server-va-9163"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HHXH-QPHC-V423
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-28 03:30Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.nepxion:discovery"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.16.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23464"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-28T03:30:26Z",
"nvd_published_at": "2022-09-24T05:15:00Z",
"severity": "MODERATE"
},
"details": "Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate\u2019s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.",
"id": "GHSA-hhxh-qphc-v423",
"modified": "2022-09-28T03:30:26Z",
"published": "2022-09-25T00:00:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23464"
},
{
"type": "PACKAGE",
"url": "https://github.com/Nepxion/Discovery"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Nepxion Discovery vulnerable to potential Information Disclosure due to Server-Side Request Forgery "
}
GHSA-HJ3R-2HQM-4F6W
Vulnerability from github – Published: 2023-12-19 18:30 – Updated: 2023-12-19 18:30An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.
{
"affected": [],
"aliases": [
"CVE-2023-46262"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-19T16:15:11Z",
"severity": "HIGH"
},
"details": "An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.",
"id": "GHSA-hj3r-2hqm-4f6w",
"modified": "2023-12-19T18:30:31Z",
"published": "2023-12-19T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46262"
},
{
"type": "WEB",
"url": "https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJ6F-7HP7-XG69
Vulnerability from github – Published: 2025-09-03 22:11 – Updated: 2025-09-03 22:11Summary
Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed
Details
When sending webhooks, the destination is not validated, causing SSRF.
Impact
Bypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.
Resources
https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "mautic/core"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "mautic/core"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-alpha"
},
{
"fixed": "5.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "mautic/core"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0-alpha"
},
{
"fixed": "6.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-9821"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-03T22:11:32Z",
"nvd_published_at": "2025-09-03T10:15:38Z",
"severity": "LOW"
},
"details": "### Summary\nUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\n\n### Details\nWhen sending webhooks, the destination is not validated, causing SSRF.\n\n### Impact\nBypass of firewalls to interact with internal services. \nSee https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.\n\n### Resources\nhttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix",
"id": "GHSA-hj6f-7hp7-xg69",
"modified": "2025-09-03T22:11:32Z",
"published": "2025-09-03T22:11:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9821"
},
{
"type": "WEB",
"url": "https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b"
},
{
"type": "WEB",
"url": "https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba"
},
{
"type": "PACKAGE",
"url": "https://github.com/mautic/mautic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mautic vulnerable to SSRF via webhook function"
}
GHSA-HJ87-9MRP-3RP8
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.
{
"affected": [],
"aliases": [
"CVE-2021-25241"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.",
"id": "GHSA-hj87-9mrp-3rp8",
"modified": "2022-05-24T17:41:07Z",
"published": "2022-05-24T17:41:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25241"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000284202"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000284206"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-114"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HJ9F-H3QV-VPJM
Vulnerability from github – Published: 2025-01-14 03:31 – Updated: 2025-01-14 03:31Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2025-23082"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T02:15:08Z",
"severity": "HIGH"
},
"details": "Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-hj9f-h3qv-vpjm",
"modified": "2025-01-14T03:31:42Z",
"published": "2025-01-14T03:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23082"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4709"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJFC-FR87-QRCW
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks allows Server Side Request Forgery. This issue affects Nexa Blocks: from n/a through 1.1.0.
{
"affected": [],
"aliases": [
"CVE-2025-30976"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:37Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks allows Server Side Request Forgery. This issue affects Nexa Blocks: from n/a through 1.1.0.",
"id": "GHSA-hjfc-fr87-qrcw",
"modified": "2026-04-01T18:35:20Z",
"published": "2025-06-06T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30976"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/nexa-blocks/vulnerability/wordpress-nexa-blocks-1-1-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJHC-CM5P-86HQ
Vulnerability from github – Published: 2022-05-14 03:08 – Updated: 2022-05-14 03:08Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.
{
"affected": [],
"aliases": [
"CVE-2018-12678"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-22T18:29:00Z",
"severity": "CRITICAL"
},
"details": "Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.",
"id": "GHSA-hjhc-cm5p-86hq",
"modified": "2022-05-14T03:08:11Z",
"published": "2022-05-14T03:08:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12678"
},
{
"type": "WEB",
"url": "https://github.com/portainer/portainer/pull/1979"
},
{
"type": "WEB",
"url": "https://github.com/portainer/portainer/releases/tag/1.18.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.