CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,714 vulnerabilities with CWE-918
CVE-2024-48944 MEDIUM
Apache Kylin 5.0.0-5.0.1 - Authenticated Server-Side Request Forgery via Diag API
CVSS 6.5
CVE-2024-13411 MEDIUM
Zapier for WordPress <= 1.5.1 - Authenticated Server-Side Request Forgery via updated_user()
CVSS 6.4
CVE-2024-10207 MEDIUM
B&R APROL < 4.4-00P5 - Authenticated Server-Side Request Forgery
CVE-2024-10206 MEDIUM
B&R APROL < 4.4-00P5 - Unauthenticated Server-Side Request Forgery
CVE-2024-13856 MEDIUM
Make Builder <1.1.10 - SSRF
CVSS 6.4
CVE-2024-48590 CRITICAL
Inflectra SpiraTeam 7.2.00 - Server-Side Request Forgery via NewsReaderService
CVSS 9.8
CVE-2024-13923 HIGH
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated Server-Side Request Forgery via validate_file()
CVSS 7.6
CVE-2024-9309 CRITICAL
Hliu Llava - Server-Side Request Forgery
CVSS 9.3
CVE-2024-8955 HIGH
Composio 0.4.4 BrowserTool Actions - Server-Side Request Forgery File Read
CVSS 7.5
CVE-2024-8952 HIGH
Composio 0.4.2 WEBTOOL_SCRAPE_WEBSITE_CONTENT - Server-Side Request Forgery
CVSS 7.5
CVE-2024-8099 HIGH
vanna-ai/vanna - Server-Side Request Forgery via DuckDB SQL Query Functions
CVSS 8.3
CVE-2024-7959 HIGH
open-webui 0.3.8 - Server-Side Request Forgery via OpenAI URL Parameter
CVSS 7.7
CVE-2024-12882 HIGH
ComfyUI 0.2.4 Model Download APIs - Server-Side Request Forgery
CVSS 7.5
CVE-2024-12779 HIGH
ragflow 0.12.0 - Server-Side Request Forgery via OPENAITTS api_base Parameter
CVSS 7.5
CVE-2024-12775 MEDIUM
langgenius/dify 0.10.1 - Server-Side Request Forgery via Custom Tool Test API
CVSS 6.5
CVE-2024-12766 HIGH
lollms_web_ui V13 - Server-Side Request Forgery via API Proxy Endpoint
CVSS 7.5
CVE-2024-12450 CRITICAL
ragflow 0.12.0 - Server-Side Request Forgery and Arbitrary File Read via web_crawl URL Parameter
CVSS 9.8
CVE-2024-12392 MEDIUM
binary-husky gpt_academic - Server-Side Request Forgery via Arxiv Paper Download URL
CVSS 6.5
CVE-2024-12376 HIGH
lm-sys fastchat - Server-Side Request Forgery
CVSS 7.5
CVE-2024-12068 HIGH
Hliu Llava - Server-Side Request Forgery
CVSS 7.5
CVE-2024-11822 HIGH
dify 0.9.1 - Server-Side Request Forgery via API Endpoint Parameter
CVSS 7.5
CVE-2024-11603 HIGH
lm-sys fastchat 0.2.36 - Server-Side Request Forgery via Queue Join Endpoint Path Parameter
CVSS 7.5
CVE-2024-11449 HIGH
hliu/large_language_and_vision_assistant 1.2.0 - Server-Side Request Forgery via Path Parameter
CVSS 7.5
CVE-2024-11031 HIGH
binary-husky gpt_academic 3.83 - Server-Side Request Forgery via Markdown_Translate.get_files_from_everything API
CVSS 7.5
CVE-2024-11030 HIGH
GPT Academic 3.83 - Server-Side Request Forgery via HotReload Plugin
CVSS 7.5
Details
Vulnerabilities 2,714
Links
MITRE CWE Entry Search this CWE With Exploits