CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-J665-969M-HG73
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2025-10-22 00:32Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
{
"affected": [],
"aliases": [
"CVE-2021-27103"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.",
"id": "GHSA-j665-969m-hg73",
"modified": "2025-10-22T00:32:03Z",
"published": "2022-05-24T17:42:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27103"
},
{
"type": "WEB",
"url": "https://github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt"
},
{
"type": "WEB",
"url": "https://www.accellion.com/products/fta"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27103"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J66Q-H2JJ-3578
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
{
"affected": [],
"aliases": [
"CVE-2021-24472"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-02T11:15:00Z",
"severity": "CRITICAL"
},
"details": "The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.",
"id": "GHSA-j66q-h2jj-3578",
"modified": "2022-05-24T19:09:39Z",
"published": "2022-05-24T19:09:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24472"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J6C2-7RV4-43QJ
Vulnerability from github – Published: 2025-12-09 00:31 – Updated: 2025-12-11 00:30IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2025-12832"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T22:15:49Z",
"severity": "MODERATE"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated\u00a0attacker to send unauthorized requests from the system, potentially leading to network enumeration or\u00a0facilitating other attacks.",
"id": "GHSA-j6c2-7rv4-43qj",
"modified": "2025-12-11T00:30:28Z",
"published": "2025-12-09T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12832"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7253507"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J6C7-M83J-8WQG
Vulnerability from github – Published: 2024-06-27 21:32 – Updated: 2024-06-27 21:32A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potentially bypassing security controls and accessing sensitive data.
{
"affected": [],
"aliases": [
"CVE-2024-5822"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-27T19:15:16Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions \u003c= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potentially bypassing security controls and accessing sensitive data.",
"id": "GHSA-j6c7-m83j-8wqg",
"modified": "2024-06-27T21:32:08Z",
"published": "2024-06-27T21:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5822"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b24f1b5f-a529-435b-ac4d-5ca71d5d1fb5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J6F9-FRHX-WFQ4
Vulnerability from github – Published: 2026-10-05 12:31 – Updated: 2026-10-05 12:31A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-105290"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-05T11:16:46Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-j6f9-frhx-wfq4",
"modified": "2026-10-05T12:31:26Z",
"published": "2026-10-05T12:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105290"
},
{
"type": "WEB",
"url": "https://github.com/feelec-yishu/feelcrm-os/issues/4"
},
{
"type": "WEB",
"url": "https://github.com/feelec-yishu/feelcrm-os"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-105290"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/977520"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/413471"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/413471/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J6GP-9P24-6XR9
Vulnerability from github – Published: 2023-08-30 15:30 – Updated: 2023-08-30 15:30Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
{
"affected": [],
"aliases": [
"CVE-2023-4624"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-30T13:15:15Z",
"severity": "LOW"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.",
"id": "GHSA-j6gp-9p24-6xr9",
"modified": "2023-08-30T15:30:19Z",
"published": "2023-08-30T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4624"
},
{
"type": "WEB",
"url": "https://github.com/bookstackapp/bookstack/commit/c324ad928dbdd54ce5b09eb0dabe60ef9de1ea38"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J6JH-78H2-2667
Vulnerability from github – Published: 2026-09-15 18:32 – Updated: 2026-09-15 18:32Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.
{
"affected": [],
"aliases": [
"CVE-2026-91938"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T16:17:45Z",
"severity": "HIGH"
},
"details": "Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.",
"id": "GHSA-j6jh-78h2-2667",
"modified": "2026-09-15T18:32:28Z",
"published": "2026-09-15T18:32:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9cvr-5wv9-2gxr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91938"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/flowise-before-3.1.4-server-side-request-forgery-via-document-loaders"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J6MR-CM6X-H6JG
Vulnerability from github – Published: 2022-05-17 02:52 – Updated: 2024-05-14 21:32An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "glance"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7200"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:32:12Z",
"nvd_published_at": "2017-03-21T06:59:00Z",
"severity": "MODERATE"
},
"details": "An SSRF issue was discovered in OpenStack Glance before Newton. The \u0027copy_from\u0027 feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as \u0027http://localhost:22\u0027. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.",
"id": "GHSA-j6mr-cm6x-h6jg",
"modified": "2024-05-14T21:32:12Z",
"published": "2022-05-17T02:52:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7200"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/b1ac90f7914d91b25144cc4063fa994fb5019ee3"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossn/+bug/1153614"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossn/+bug/1606495"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/glance"
},
{
"type": "WEB",
"url": "https://wiki.openstack.org/wiki/OSSN/OSSN-0078"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96988"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Glance Server-Side Request Forgery (SSRF)"
}
GHSA-J6QX-2X9M-X936
Vulnerability from github – Published: 2026-04-29 00:30 – Updated: 2026-04-29 00:30A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): "Triggers are manually activated and involve login and access control, thus requiring management." The pull request by the researcher got rejected because of that.
{
"affected": [],
"aliases": [
"CVE-2026-7305"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T22:16:50Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): \"Triggers are manually activated and involve login and access control, thus requiring management.\" The pull request by the researcher got rejected because of that.",
"id": "GHSA-j6qx-2x9m-x936",
"modified": "2026-04-29T00:30:23Z",
"published": "2026-04-29T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7305"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3935"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/pull/3937"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/803076"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359960"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359960/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J753-JWGQ-FWXJ
Vulnerability from github – Published: 2026-09-29 21:33 – Updated: 2026-09-29 21:33Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-102877"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T20:17:18Z",
"severity": "LOW"
},
"details": "Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.",
"id": "GHSA-j753-jwgq-fwxj",
"modified": "2026-09-29T21:33:25Z",
"published": "2026-09-29T21:33:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102877"
},
{
"type": "WEB",
"url": "https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69"
},
{
"type": "WEB",
"url": "https://github.com/getfider/fider"
},
{
"type": "WEB",
"url": "https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go"
},
{
"type": "WEB",
"url": "https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go"
},
{
"type": "WEB",
"url": "https://github.com/getfider/fider/releases/tag/v0.38.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.