CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,723 vulnerabilities with CWE-918
CVE-2024-12450 CRITICAL
ragflow 0.12.0 - Server-Side Request Forgery and Arbitrary File Read via web_crawl URL Parameter
CVSS 9.8
CVE-2024-12392 MEDIUM
binary-husky gpt_academic - Server-Side Request Forgery via Arxiv Paper Download URL
CVSS 6.5
CVE-2024-12376 HIGH
lm-sys fastchat - Server-Side Request Forgery
CVSS 7.5
CVE-2024-12068 HIGH
Hliu Llava - Server-Side Request Forgery
CVSS 7.5
CVE-2024-11822 HIGH
dify 0.9.1 - Server-Side Request Forgery via API Endpoint Parameter
CVSS 7.5
CVE-2024-11603 HIGH
lm-sys fastchat 0.2.36 - Server-Side Request Forgery via Queue Join Endpoint Path Parameter
CVSS 7.5
CVE-2024-11449 HIGH
hliu/large_language_and_vision_assistant 1.2.0 - Server-Side Request Forgery via Path Parameter
CVSS 7.5
CVE-2024-11031 HIGH
binary-husky gpt_academic 3.83 - Server-Side Request Forgery via Markdown_Translate.get_files_from_everything API
CVSS 7.5
CVE-2024-11030 HIGH
GPT Academic 3.83 - Server-Side Request Forgery via HotReload Plugin
CVSS 7.5
CVE-2024-10457 MEDIUM
significant-gravitas/autogpt <0.1.1 - SSRF
CVSS 6.5
CVE-2024-49822 MEDIUM
IBM QRadar Advisor 1.0.0-2.6.5 - Authenticated Server-Side Request Forgery
CVSS 4.1
CVE-2024-13838 MEDIUM
Uncanny Automator < 6.3 - Authenticated Server-Side Request Forgery via call_webhook Method
CVSS 5.5
CVE-2024-13924 MEDIUM
FancyWP Starter Templates <= 2.0.0 - Blind SSRF via http_request_host_is_external
CVSS 5.3
CVE-2024-53696 MEDIUM
QuLog Center 1.7.0-1.7.0.828, QTS 4.5.1-4.5.4.2956, QuTS hero h4.5.0-h4.5.4.2475 - SSRF
CVSS 4.9
CVE-2024-13857 MEDIUM
WPGet API - Connect to any external REST API <= 2.2.10 - Authenticated Server-Side Request Forgery
CVSS 5.5
CVE-2024-13904 MEDIUM
Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery via Hooks Function
CVSS 5.3
CVE-2024-13697 MEDIUM
Better Messages < 2.7.4 - Unauthenticated Server-Side Request Forgery via Nice Links
CVSS 4.8
CVE-2024-13907 MEDIUM
Total Upkeep WordPress Plugin <= 1.16.8 - Authenticated SSRF via Download Function
CVSS 4.9
CVE-2024-13905 MEDIUM
OneStore Sites <= 0.1.1 - Unauthenticated Server-Side Request Forgery via class-export.php
CVSS 5.3
CVE-2024-30150 MEDIUM
HCL MyCloud - Unauthenticated Privilege Escalation and Information Disclosure
CVSS 5.3
CVE-2024-13695 MEDIUM
Enfold < 6.0.9 - Authenticated Server-Side Request Forgery via attachment_id Parameter
CVSS 6.4
CVE-2024-37359 HIGH
Hitachi Vantara Pentaho Business Analytics Server <10.2.0.0-9.3.0.9...
CVSS 8.6
CVE-2024-13741 MEDIUM
ProfileGrid <= 5.9.4.2 - Authenticated Limited SSRF via pm_upload_image
CVSS 5.4
CVE-2024-13879 MEDIUM
Stream plugin for WordPress <4.0.2 - SSRF
CVSS 5.5
CVE-2024-13834 MEDIUM
Responsive Plus - Elementor Templates & Starter Sites <= 3.1.4 - Server-Side Request Forgery
CVSS 5.4
Details
Vulnerabilities 2,723