CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,742 vulnerabilities with CWE-918
CVE-2023-50259
MEDIUM
Medusa < 1.0.19 - Unauthenticated Server-Side Request Forgery via Slack Webhook URL
CVSS 5.3
CVE-2023-50258
MEDIUM
Medusa < 1.0.19 - Unauthenticated Server-Side Request Forgery via Discord Webhook URL
CVSS 5.3
CVE-2023-7037
MEDIUM
Automad < 1.10.9 - Server-Side Request Forgery via FileController Import URL
CVSS 6.3
CVE-2023-6974
CRITICAL
MLflow < 2.9.2 - Server-Side Request Forgery
CVSS 9.8
CVE-2023-46262
HIGH
Ivanti Avalanche Remote Control - SSRF
CVSS 7.5
CVE-2023-6853
MEDIUM
KodExplorer < 4.52.01 - Server-Side Request Forgery via OfficeLive Plugin Path Parameter
CVSS 6.3
CVE-2023-6852
MEDIUM
kodcloud kodexplorer < 4.52.01 - Server-Side Request Forgery via webodf Plugin
CVSS 6.3
CVE-2023-6849
HIGH
kodbox < 1.48.04 - Server-Side Request Forgery via FileThumb Plugin Path Parameter
CVSS 7.3
CVE-2023-50266
MEDIUM
Bazarr 1.2.4 - Blind Server-Side Request Forgery via Proxy Endpoint
CVSS 5.3
CVE-2023-49159
HIGH
CommentLuv < 3.0.4 - Server-Side Request Forgery
CVSS 7.2
CVE-2023-48379
MEDIUM
Softnext Mail SQR Expert < 230330 - Unauthenticated Blind Server-Side Request Forgery via URL Parameter
CVSS 5.3
CVE-2023-6570
MEDIUM
kubeflow - Server-Side Request Forgery
CVSS 6.5
CVE-2023-40630
CRITICAL
jcdashboard 1.0.0-1.1.29 - Unauthenticated Server-Side Request Forgery
CVSS 9.8
CVE-2023-47619
HIGH
audiobookshelf < 2.4.3 - Authenticated Server-Side Request Forgery and Arbitrary File Read/Delete via Update Permission
CVSS 8.1
CVE-2023-49795
MEDIUM
MindsDB < 23.11.4.1 - Server-Side Request Forgery in file.py
CVSS 6.5
CVE-2023-49799
HIGH
nuxt-api-party < 0.22.0 - Server-Side Request Forgery via Leading Whitespace Bypass
CVSS 7.5
CVE-2023-49746
MEDIUM
SpeedyCache < 1.1.2 - Server-Side Request Forgery
CVSS 4.9
CVE-2023-46641
MEDIUM
WordPress 12 Step Meeting List <=3.14.24 - Server-Side Request Forgery
CVSS 4.9
CVE-2023-41804
HIGH
Brainstorm Force Starter Templates <= 3.2.4 - Server-Side Request Forgery
CVSS 7.1
CVE-2023-46736
MEDIUM
EspoCRM <8.0.5 - Server-Side Request Forgery via Image URL Upload
CVSS 5.3
CVE-2023-48910
CRITICAL
microcks < 1.17.1 - Server-Side Request Forgery via /jobs and /artifact/download
CVSS 9.8
CVE-2023-46746
MEDIUM
PostHog - Authenticated Server-Side Request Forgery via Webhook URL
CVSS 4.8
CVE-2023-49094
MEDIUM
Sentry Symbolicator >=0.3.3 <23.11.2 - Server-Side Request Forgery via Crafted HTTP Endpoint
CVSS 4.3
CVE-2023-6070
MEDIUM
Trellix ESM <11.6.8 - Authenticated Server-Side Request Forgery via Certificate Upload
CVSS 4.3
CVE-2023-48023
CRITICAL
Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery via Log Proxy Endpoint
CVSS 9.1
Details
Vulnerabilities
2,742