CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-FWHC-MM9Q-MQQ8
Vulnerability from github – Published: 2024-05-22 21:30 – Updated: 2024-05-23 14:18A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "vufind/vufind"
},
"ranges": [
{
"events": [
{
"introduced": "2.4"
},
{
"fixed": "9.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-25737"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-23T14:13:15Z",
"nvd_published_at": "2024-05-22T19:15:08Z",
"severity": "CRITICAL"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.",
"id": "GHSA-fwhc-mm9q-mqq8",
"modified": "2024-05-23T14:18:28Z",
"published": "2024-05-22T21:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25737"
},
{
"type": "WEB",
"url": "https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b"
},
{
"type": "WEB",
"url": "https://github.com/vufind-org/vufind/commit/51f2ddac0dc1047e6fd3b27e6d984b19e1601d00"
},
{
"type": "PACKAGE",
"url": "https://github.com/vufind-org/vufind"
},
{
"type": "WEB",
"url": "https://vufind.org/wiki/security:cve-2024-25737"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "VuFind Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-FWHW-CHW4-GH37
Vulnerability from github – Published: 2026-02-02 09:30 – Updated: 2026-02-02 21:23A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-parent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-1518"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T21:23:18Z",
"nvd_published_at": "2026-02-02T08:16:06Z",
"severity": "LOW"
},
"details": "A flaw was found in Keycloak\u2019s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.",
"id": "GHSA-fwhw-chw4-gh37",
"modified": "2026-02-02T21:23:18Z",
"published": "2026-02-02T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1518"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-1518"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433727"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-FWJQ-J8GC-2F24
Vulnerability from github – Published: 2022-06-24 00:00 – Updated: 2022-06-30 00:00OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
{
"affected": [],
"aliases": [
"CVE-2022-34013"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.",
"id": "GHSA-fwjq-j8gc-2f24",
"modified": "2022-06-30T00:00:37Z",
"published": "2022-06-24T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34013"
},
{
"type": "WEB",
"url": "https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWP2-VG7P-F8X2
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-14 21:31A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-90814"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T20:17:02Z",
"severity": "LOW"
},
"details": "A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-fwp2-vg7p-f8x2",
"modified": "2026-09-14T21:31:46Z",
"published": "2026-09-14T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90814"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/81"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90814"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/922880"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403316"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403316/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWP6-82JC-56PC
Vulnerability from github – Published: 2026-09-15 15:32 – Updated: 2026-09-15 21:31An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
{
"affected": [],
"aliases": [
"CVE-2026-79425"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T15:17:21Z",
"severity": "HIGH"
},
"details": "An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.",
"id": "GHSA-fwp6-82jc-56pc",
"modified": "2026-09-15T21:31:14Z",
"published": "2026-09-15T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79425"
},
{
"type": "WEB",
"url": "https://github.com/crmeb/CRMEB"
},
{
"type": "WEB",
"url": "https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-79425.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWQW-PR3C-3J3R
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-23 00:03An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
{
"affected": [],
"aliases": [
"CVE-2022-26499"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T05:15:00Z",
"severity": "CRITICAL"
},
"details": "An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it\u0027s possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.",
"id": "GHSA-fwqw-pr3c-3j3r",
"modified": "2022-04-23T00:03:21Z",
"published": "2022-04-16T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26499"
},
{
"type": "WEB",
"url": "https://downloads.asterisk.org/pub/security"
},
{
"type": "WEB",
"url": "https://downloads.asterisk.org/pub/security/AST-2022-002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5285"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWVG-2739-22V7
Vulnerability from github – Published: 2023-12-29 19:36 – Updated: 2023-12-29 19:36Impact
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
Patches
The issue was fixed in miniflare@3.20231030.2.
Workarounds
Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.
References
- https://github.com/cloudflare/workers-sdk/pull/4532
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "miniflare"
},
"ranges": [
{
"events": [
{
"introduced": "3.20230821.0"
},
{
"fixed": "3.20231030.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-7078"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-29T19:36:41Z",
"nvd_published_at": "2023-12-29T12:15:47Z",
"severity": "HIGH"
},
"details": "### Impact\nSending specially crafted HTTP requests to Miniflare\u0027s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers.\n\n### Patches\nThe issue was fixed in `miniflare@3.20231030.2`.\n\n### Workarounds\nEnsure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: \"127.0.0.1\"` option.\n\n### References\n- https://github.com/cloudflare/workers-sdk/pull/4532\n",
"id": "GHSA-fwvg-2739-22v7",
"modified": "2023-12-29T19:36:41Z",
"published": "2023-12-29T19:36:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7078"
},
{
"type": "WEB",
"url": "https://github.com/cloudflare/workers-sdk/pull/4532"
},
{
"type": "PACKAGE",
"url": "https://github.com/cloudflare/workers-sdk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Miniflare vulnerable to Server-Side Request Forgery (SSRF)"
}
GHSA-FX75-97X2-V9J2
Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-11 21:32The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
{
"affected": [],
"aliases": [
"CVE-2026-14860"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T07:16:47Z",
"severity": "MODERATE"
},
"details": "The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.",
"id": "GHSA-fx75-97x2-v9j2",
"modified": "2026-08-11T21:32:29Z",
"published": "2026-08-10T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14860"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/ea752266-9bff-4c36-91aa-9aca0232c7af"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FX92-VCGX-G354
Vulnerability from github – Published: 2026-03-12 00:31 – Updated: 2026-03-12 00:31A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-translator-main/server/request_extraction.py of the component Translate Endpoints. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-3961"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T22:16:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-translator-main/server/request_extraction.py of the component Translate Endpoints. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-fx92-vcgx-g354",
"modified": "2026-03-12T00:31:17Z",
"published": "2026-03-12T00:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3961"
},
{
"type": "WEB",
"url": "https://github.com/zyddnys/manga-image-translator/issues/1118"
},
{
"type": "WEB",
"url": "https://github.com/zyddnys/manga-image-translator/issues/1119"
},
{
"type": "WEB",
"url": "https://github.com/zyddnys/manga-image-translator"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.350390"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.350390"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768180"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768210"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768211"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768212"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768214"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768224"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.768225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FXJG-28FM-PFXH
Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2025-02-13 18:54A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-superset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-25504"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T22:10:49Z",
"nvd_published_at": "2023-04-17T17:15:00Z",
"severity": "MODERATE"
},
"details": "A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists\u00a0in Apache Superset versions up to and including 2.0.1.",
"id": "GHSA-fxjg-28fm-pfxh",
"modified": "2025-02-13T18:54:17Z",
"published": "2023-07-06T19:24:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25504"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/superset"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/04/18/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Superset Server-Side Request Forgery vulnerability"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.