CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,750 vulnerabilities with CWE-918
CVE-2022-34013 MEDIUM
OneBlog 2.3.4 - Server-Side Request Forgery via Logo Parameter
CVSS 4.3
CVE-2022-34011 MEDIUM
OneBlog v2.3.4 - Server-Side Request Forgery via entryUrls Parameter
CVSS 4.3
CVE-2022-23080 MEDIUM
Directus 9.0.0-beta.2-9.6.0 - Server-Side Request Forgery via Media Upload Functionality
CVSS 5.0
CVE-2022-23071 MEDIUM
Tandoor Recipes 0.9.1-1.2.5 - Server-Side Request Forgery via Import Recipe Functionality
CVSS 6.5
CVE-2022-29612 MEDIUM
SAP Host Agent and NetWeaver ABAP - Authenticated Server-Side Request Forgery via sapcontrol startservice
CVSS 4.3
CVE-2022-28217 MEDIUM
SAP NetWeaver - Server-Side Request Forgery via XML Document Validation Bypass
CVSS 6.5
CVE-2022-24969 MEDIUM
Apache Dubbo < 2.6.12 and 2.7.0-2.7.14 - Server-Side Request Forgery via parseURL Method
CVSS 6.1
CVE-2022-31830 CRITICAL
Kity Minder v1.3.5 - Server-Side Request Forgery via ImageCapture.class.php Init Function
CVSS 9.1
CVE-2022-31827 CRITICAL
MonstaFTP 2.10.3 - Server-Side Request Forgery via HTTPFetcher.php
CVSS 9.1
CVE-2022-31393 CRITICAL
jizhicms v2.2.5 - Server-Side Request Forgery via Index Function in PluginsController
CVSS 9.1
CVE-2022-31390 CRITICAL
jizhicms 2.2.5 - Server-Side Request Forgery via Update Function in TemplateController
CVSS 9.1
CVE-2022-31386 CRITICAL
nbnbk cms 3 - Server-Side Request Forgery via getFileBinary URL Parameter
CVSS 9.1
CVE-2022-27780 HIGH
curl 7.80.0-7.83.0 - URL Hostname Spoofing via Percent-Encoded Separator Bypass
CVSS 7.5
CVE-2022-1285 MEDIUM
Gogs < 0.12.8 - Server-Side Request Forgery
CVSS 6.5
CVE-2022-1815 HIGH
drawio < 18.1.2 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-29309 HIGH
mysiteforme 2.2.1 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-28997 HIGH
CSZCMS 1.3.0 - Server-Side Request Forgery via File Manager Connector
CVSS 7.5
CVE-2022-29188 MEDIUM
Smokescreen <0.0.4 - Deny List Bypass via Bracketed Hostname
CVSS 5.3
CVE-2022-1784 HIGH
drawio < 18.0.8 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-1767 HIGH
drawio < 18.0.7 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-28616 CRITICAL
HPE OneView < 7.0 - Server-Side Request Forgery
CVSS 9.8
CVE-2022-24856 CRITICAL
FlyteConsole < 0.52.0 - Server-Side Request Forgery via CORS Proxy
CVSS 9.1
CVE-2022-1711 HIGH
drawio < 18.0.5 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-1723 HIGH
drawio < 18.0.6 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-23668 MEDIUM
Aruba ClearPass Policy Manager <= 6.10.4, <= 6.9.9, <= 6.8.9-HF2, <= 6.7.x - Authenticated Server-Side Request Forgery
CVSS 4.9
Details
Vulnerabilities 2,750