CWE-441
Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
109 vulnerabilities with CWE-441
CVE-2025-22441
HIGH
Android - Local Privilege Escalation via RemoteViews Confused Deputy
CVSS 7.3
CVE-2025-26452
HIGH
Android - Local Privilege Escalation via Confused Deputy in ResourcesImpl
CVSS 7.8
CVE-2025-22418
HIGH
Multiple Locations - Privilege Escalation
CVSS 7.8
CVE-2025-22416
HIGH
Android - Unintended Proxy or Intermediary in ChooserActivity
CVSS 7.8
CVE-2025-48710
MEDIUM
kro 0.1.0-0.2.1 - Attacker-Controlled Container Image Execution
CVSS 4.1
CVE-2025-47269
HIGH
code-server < 4.99.4 - Unintended Proxy via Malicious URL
CVSS 8.3
CVE-2025-25061
MEDIUM
HMI ViewJet/HMI GC-A2 - Info Disclosure
CVSS 5.8
CVE-2025-25306
CRITICAL
Misskey < 2025.2.1 - Unintended Proxy via ActivityPub Object Field Validation Bypass
CVSS 9.3
CVE-2025-23217
HIGH
mitmproxy < 11.1.2 - Server-Side Request Forgery via Proxy to Internal API
CVE-2024-9870
MEDIUM
GitLab 15.11-17.6.5, 17.7-17.7.4, 17.8-17.8.2 - Server-Side Request Forgery
CVSS 4.3
CVE-2024-30128
HIGH
HCL Nomad Server on Domino - Open Proxy IP Masking
CVSS 8.6
CVE-2024-31319
HIGH
Android - Local Privilege Escalation via Notification Channel Update Confused Deputy
CVSS 7.8
CVE-2024-34068
MEDIUM
Pterodactyl Panel <1.11.2 - Auth Bypass
CVSS 6.4
CVE-2023-31313
HIGH
AMD PMFW - Privileged SMU Message Arbitrary Code Execution
CVSS 7.2
CVE-2023-40111
HIGH
Android - Local Privilege Escalation via MediaSessionRecord Confused Deputy
CVSS 7.8
CVE-2023-33188
MEDIUM
Omni-notes < 6.2.6 - Unintended File Copy via Insufficient Path Validation
CVSS 6.3
CVE-2023-21082
MEDIUM
Android - Local Information Disclosure via Confused Deputy in NewOutgoingCallIntentBroadcaster
CVSS 5.5
CVE-2022-39361
HIGH
Metabase 0.41.0-0.41.8 - Remote Code Execution via H2 Database DDL Statements
CVSS 8.8
CVE-2022-39349
MEDIUM
Tasks.org < 12.7.1 - Unintended Proxy via ShareLinkActivity File Path Handling
CVSS 5.5
CVE-2021-20042
CRITICAL
SonicWall SMA 100 - Unauthenticated Proxy Bypass
CVSS 9.8
CVE-2021-25740
LOW
Kubernetes - Confused Deputy Network Access
CVSS 3.1
CVE-2021-32783
HIGH
Contour < 1.17.1 and >= 0 < 1.14.2 - Unauthenticated Denial of Service via ExternalName Service
CVSS 8.5
CVE-2021-32773
MEDIUM
Racket < 8.2 - Unintended Proxy or Intermediary via Sandbox Module Dependency Confusion
CVSS 6.1
CVE-2020-8561
MEDIUM
Kubernetes API Server - Server-Side Request Forgery via Webhook Response Redirects
CVSS 4.1
CVE-2020-26262
HIGH
coturn < 4.5.2 - Unintended Proxy Access via Loopback Address Bypass
CVSS 7.2
Details
Vulnerabilities
109