CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

92 vulnerabilities with CWE-441
CVE-2022-39361 HIGH
Metabase 0.41.0-0.41.8 - Remote Code Execution via H2 Database DDL Statements
CVSS 8.8
CVE-2022-39349 MEDIUM
Tasks.org < 12.7.1 - Unintended Proxy via ShareLinkActivity File Path Handling
CVSS 5.5
CVE-2021-20042 CRITICAL
SonicWall SMA 100 - Unauthenticated Proxy Bypass
CVSS 9.8
CVE-2021-25740 LOW
Kubernetes - Confused Deputy Network Access
CVSS 3.1
CVE-2021-32783 HIGH
Contour < 1.17.1 and >= 0 < 1.14.2 - Unauthenticated Denial of Service via ExternalName Service
CVSS 8.5
CVE-2021-32773 MEDIUM
Racket < 8.2 - Unintended Proxy or Intermediary via Sandbox Module Dependency Confusion
CVSS 6.1
CVE-2020-8561 MEDIUM
Kubernetes API Server - Server-Side Request Forgery via Webhook Response Redirects
CVSS 4.1
CVE-2020-26262 HIGH
coturn < 4.5.2 - Unintended Proxy Access via Loopback Address Bypass
CVSS 7.2
CVE-2020-5412 MEDIUM
Spring Cloud Netflix <2.2.4-2.1.6 - SSRF
CVSS 6.5
CVE-2019-3996 MEDIUM
elog < 3.1.4-57bea22 - Unauthenticated HTTP Request Smuggling via Crafted POST Requests
CVSS 6.5
CVE-2019-1841 MEDIUM
Cisco Catalyst Center < 1.2.5 - Authenticated Unintended Proxy Access via HTTP Request
CVSS 6.5
CVE-2019-3924 HIGH
MikroTik RouterOS <6.43.12-6.42.12 - RCE
CVSS 7.5
CVE-2018-12182 MEDIUM
EDK II - Privilege Escalation/Info Disclosure/Denial of Service
CVSS 6.7
CVE-2018-16598 MEDIUM
AWS FreeRTOS <10.0.1 - Info Disclosure
CVSS 5.9
CVE-2018-1999038 MEDIUM
Jenkins Publisher Over CIFS Plugin <0.10 - Confused Deputy
CVSS 4.2
CVE-2015-10003 MEDIUM
FileZilla Server <0.9.50 - Info Disclosure
CVSS 4.3
CVE-2015-2947 CRITICAL
KanColleViewer <3.8.1 - Open Redirect
CVSS 9.1
Details
Vulnerabilities 92