CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-CXPR-7W85-VGJ4
Vulnerability from github – Published: 2025-09-22 18:30 – Updated: 2025-09-22 18:30A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
{
"affected": [],
"aliases": [
"CVE-2025-10787"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T07:15:40Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.",
"id": "GHSA-cxpr-7w85-vgj4",
"modified": "2025-09-22T18:30:36Z",
"published": "2025-09-22T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10787"
},
{
"type": "WEB",
"url": "https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXV34"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.325144"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.325144"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.653888"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CXQ5-97V7-87J8
Vulnerability from github – Published: 2026-09-02 14:54 – Updated: 2026-09-02 14:54Summary
Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the $ref resolver.
Details
$ref: http://attacker/internal-evil.json#/...→ build host fetches (SSRF) and inlines the remote schema (RFI); confirmed propertyREMOTE_ORVAL_PROPin the generated client.$ref: /abs/path.json#/...or../../secret.json#/...→ out-of-tree local file read + inlined (LFI).
No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content
cannot break out into code. The chain stops at SSRF + RFI + LFI.
Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref
resolution to the input directory tree (reject absolute paths and ../ escapes).
PoC
reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema
inlined). Verified on Orval 8.19.0.
Impact
Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "orval"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-62680"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-829",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:54:48Z",
"nvd_published_at": "2026-08-19T18:16:54Z",
"severity": "HIGH"
},
"details": "### Summary\n\nOrval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including\nabsolute / out-of-tree paths), inlining the referenced schema into the generated client. Running\n`orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields\nSSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class\nfrom Orval\u0027s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers\nthe `$ref` resolver.\n\n### Details\n\n- `$ref: http://attacker/internal-evil.json#/...` \u2192 build host fetches (SSRF) and inlines the remote\n schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client.\n- `$ref: /abs/path.json#/...` or `../../secret.json#/...` \u2192 out-of-tree local file read + inlined (LFI).\n\nNo RCE: on 8.19.0 the description JSDoc is escaped (`*/`-\u003e`*\\/`, the published fix), so `$ref` content\ncannot break out into code. The chain stops at SSRF + RFI + LFI.\n\nFix: don\u0027t resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref`\nresolution to the input directory tree (reject absolute paths and `../` escapes).\n\n### PoC\n\n`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema\ninlined). Verified on Orval 8.19.0.\n\n### Impact\n\nBuild-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).",
"id": "GHSA-cxq5-97v7-87j8",
"modified": "2026-09-02T14:54:49Z",
"published": "2026-09-02T14:54:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62680"
},
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/pull/3723"
},
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10"
},
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"type": "PACKAGE",
"url": "https://github.com/orval-labs/orval"
},
{
"type": "WEB",
"url": "https://github.com/orval-labs/orval/releases/tag/v8.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}
GHSA-CXVM-398V-RMFG
Vulnerability from github – Published: 2025-05-29 21:31 – Updated: 2025-12-15 21:30Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.
{
"affected": [],
"aliases": [
"CVE-2025-4967"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-29T20:15:27Z",
"severity": "CRITICAL"
},
"details": "Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal\u2019s SSRF protections.",
"id": "GHSA-cxvm-398v-rmfg",
"modified": "2025-12-15T21:30:27Z",
"published": "2025-05-29T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4967"
},
{
"type": "WEB",
"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-2-patch"
},
{
"type": "WEB",
"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F23G-2F38-GG94
Vulnerability from github – Published: 2026-07-10 15:31 – Updated: 2026-07-10 15:31Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
{
"affected": [],
"aliases": [
"CVE-2026-56261"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-10T15:16:42Z",
"severity": "CRITICAL"
},
"details": "Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server\u0027s /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.",
"id": "GHSA-f23g-2f38-gg94",
"modified": "2026-07-10T15:31:39Z",
"published": "2026-07-10T15:31:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56261"
},
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/crawl4ai-server-side-request-forgery-via-webhook-urls"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F274-C23V-HX4J
Vulnerability from github – Published: 2026-06-30 12:31 – Updated: 2026-06-30 12:31A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.
{
"affected": [],
"aliases": [
"CVE-2026-13316"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T11:16:29Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.",
"id": "GHSA-f274-c23v-hx4j",
"modified": "2026-06-30T12:31:52Z",
"published": "2026-06-30T12:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13316"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-13316"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490345"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F27H-6JWQ-4C83
Vulnerability from github – Published: 2026-09-02 12:31 – Updated: 2026-09-02 12:31Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
{
"affected": [],
"aliases": [
"CVE-2026-84772"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T12:17:15Z",
"severity": "MODERATE"
},
"details": "Editor Server Side Request Forgery (SSRF) in Broken Link Checker \u003c= 2.4.14 versions.",
"id": "GHSA-f27h-6jwq-4c83",
"modified": "2026-09-02T12:31:30Z",
"published": "2026-09-02T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84772"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/broken-link-checker/vulnerability/wordpress-broken-link-checker-plugin-2-4-14-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F289-G9W2-9J5H
Vulnerability from github – Published: 2023-03-28 03:30 – Updated: 2025-02-19 21:31Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).
{
"affected": [],
"aliases": [
"CVE-2023-25262"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-28T01:15:00Z",
"severity": "HIGH"
},
"details": "Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).",
"id": "GHSA-f289-g9w2-9j5h",
"modified": "2025-02-19T21:31:28Z",
"published": "2023-03-28T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25262"
},
{
"type": "WEB",
"url": "https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM"
},
{
"type": "WEB",
"url": "https://cves.at/posts/cve-2023-25262/writeup"
},
{
"type": "WEB",
"url": "http://stimulsoft.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F28J-GX5R-P78J
Vulnerability from github – Published: 2026-03-23 15:30 – Updated: 2026-04-18 06:30A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
{
"affected": [],
"aliases": [
"CVE-2026-4589"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-23T14:16:35Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.",
"id": "GHSA-f28j-gx5r-p78j",
"modified": "2026-04-18T06:30:14Z",
"published": "2026-03-23T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4589"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.352425"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.352425"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.775467"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/775467"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/352425"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/352425/cti"
},
{
"type": "WEB",
"url": "https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F2C6-8JG6-287F
Vulnerability from github – Published: 2026-07-18 18:30 – Updated: 2026-07-18 18:30A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-16128"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T17:16:38Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-f2c6-8jg6-287f",
"modified": "2026-07-18T18:30:21Z",
"published": "2026-07-18T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16128"
},
{
"type": "WEB",
"url": "https://github.com/zevorn/rt-claw/issues/140"
},
{
"type": "WEB",
"url": "https://github.com/zevorn/rt-claw"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16128"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/856873"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379840"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379840/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F2CG-3CWW-MCQ8
Vulnerability from github – Published: 2026-04-17 12:31 – Updated: 2026-04-17 12:31GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to any Windows system on which the agent is installed and which provides communication via SMB or WebDav.
This issue was fixed in version 2.8.33.
{
"affected": [],
"aliases": [
"CVE-2026-5131"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-17T11:16:11Z",
"severity": "MODERATE"
},
"details": "GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to\u00a0any Windows system\u00a0on which the agent is installed and which provides communication via SMB or WebDav.\n\nThis issue was fixed in version 2.8.33.",
"id": "GHSA-f2cg-3cww-mcq8",
"modified": "2026-04-17T12:31:25Z",
"published": "2026-04-17T12:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5131"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/04/CVE-2026-5131"
},
{
"type": "WEB",
"url": "https://www.nomios.pl/greenmod"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.