CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4788 vulnerabilities reference this CWE, most recent first.
GHSA-3G3X-QRHW-J5JJ
Vulnerability from github – Published: 2024-09-10 15:31 – Updated: 2024-09-10 18:30Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.
{
"affected": [],
"aliases": [
"CVE-2023-37230"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T14:15:12Z",
"severity": "HIGH"
},
"details": "Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.",
"id": "GHSA-3g3x-qrhw-j5jj",
"modified": "2024-09-10T18:30:44Z",
"published": "2024-09-10T15:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37230"
},
{
"type": "WEB",
"url": "https://code-white.com"
},
{
"type": "WEB",
"url": "https://code-white.com/public-vulnerability-list"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3G63-2RPP-WC2M
Vulnerability from github – Published: 2024-12-04 03:31 – Updated: 2024-12-04 03:31A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.
{
"affected": [],
"aliases": [
"CVE-2024-45206"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-04T02:15:05Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.",
"id": "GHSA-3g63-2rpp-wc2m",
"modified": "2024-12-04T03:31:16Z",
"published": "2024-12-04T03:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45206"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4649"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3GF9-WV65-GWH9
Vulnerability from github – Published: 2024-11-05 00:31 – Updated: 2024-11-07 15:05In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "gradio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.42.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-48052"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-07T15:05:10Z",
"nvd_published_at": "2024-11-04T23:15:04Z",
"severity": "MODERATE"
},
"details": "In gradio \u003c=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.",
"id": "GHSA-3gf9-wv65-gwh9",
"modified": "2024-11-07T15:05:10Z",
"published": "2024-11-05T00:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48052"
},
{
"type": "WEB",
"url": "https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12"
},
{
"type": "PACKAGE",
"url": "https://github.com/gradio-app/gradio"
},
{
"type": "WEB",
"url": "https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "gradio Server Side Request Forgery vulnerability"
}
GHSA-3GM6-8RM6-Q59F
Vulnerability from github – Published: 2026-07-19 09:31 – Updated: 2026-07-19 09:31A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
{
"affected": [],
"aliases": [
"CVE-2026-16223"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T08:16:43Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-3gm6-8rm6-q59f",
"modified": "2026-07-19T09:31:36Z",
"published": "2026-07-19T09:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16223"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM/issues/2687"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM/issues/2688"
},
{
"type": "WEB",
"url": "https://github.com/1Panel-dev/CordysCRM"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16223"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/858045"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/858046"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380045"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380045/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3GQR-3P72-MQM3
Vulnerability from github – Published: 2025-02-19 03:32 – Updated: 2025-02-19 03:32A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2025-1447"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-19T01:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component.",
"id": "GHSA-3gqr-3p72-mqm3",
"modified": "2025-02-19T03:32:05Z",
"published": "2025-02-19T03:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1447"
},
{
"type": "WEB",
"url": "https://github.com/sheratan4/cve/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/kasuganosoras/Pigeon/commit/84cea5fe73141689da2e7ec8676d47435bd6423e"
},
{
"type": "WEB",
"url": "https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.181"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.296134"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.296134"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.501978"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3GWQ-RJ9C-4F42
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 03:31SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-42965"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T01:15:23Z",
"severity": "MODERATE"
},
"details": "SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.",
"id": "GHSA-3gwq-rj9c-4f42",
"modified": "2025-07-08T03:31:00Z",
"published": "2025-07-08T03:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42965"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3598118"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H26-Q9XC-FJFF
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:53ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
{
"affected": [],
"aliases": [
"CVE-2019-9187"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-05T18:29:00Z",
"severity": "HIGH"
},
"details": "ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190226 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.",
"id": "GHSA-3h26-q9xc-fjff",
"modified": "2024-04-04T00:53:12Z",
"published": "2022-05-24T16:47:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9187"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news"
},
{
"type": "WEB",
"url": "https://ikiwiki.info/news/version_3.20190228"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HH3-HX7R-GGC2
Vulnerability from github – Published: 2026-04-09 15:35 – Updated: 2026-04-14 18:30Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
{
"affected": [],
"aliases": [
"CVE-2025-50228"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-09T15:16:07Z",
"severity": "CRITICAL"
},
"details": "Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.",
"id": "GHSA-3hh3-hx7r-ggc2",
"modified": "2026-04-14T18:30:31Z",
"published": "2026-04-09T15:35:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50228"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms/issues/104"
},
{
"type": "WEB",
"url": "https://github.com/Cherry-toto/jizhicms"
},
{
"type": "WEB",
"url": "https://www.jizhicms.cn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HR5-6MX7-874C
Vulnerability from github – Published: 2025-04-27 00:30 – Updated: 2025-04-28 12:30A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3954"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-26T22:15:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3hr5-6mx7-874c",
"modified": "2025-04-28T12:30:24Z",
"published": "2025-04-27T00:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3954"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/p/2c56b9ec-5747-40a3-b089-ff796f23ebd4"
},
{
"type": "WEB",
"url": "https://everydaysparkling.com/ssrf-via-referrer-field-in-churchcrm-v5-16-0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306290"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555938"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3HVP-8GH4-HRX5
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
{
"affected": [],
"aliases": [
"CVE-2020-25353"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-20T19:15:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.",
"id": "GHSA-3hvp-8gh4-hrx5",
"modified": "2022-05-24T19:11:48Z",
"published": "2022-05-24T19:11:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25353"
},
{
"type": "WEB",
"url": "https://stark0de.com/2020/08/27/pwning-rconfig-part-one.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.