CVE-2023-7078

HIGH

Miniflare 3.20230821.0-3.20231030.1 - Server-Side Request Forgery via Crafted HTTP Requests

Title source: llm
STIX 2.1

Description

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0007
EPSS Percentile 21.9%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-918
Status published
Products (2)
cloudflare/miniflare 3.20230821.0 - 3.20231030.2
npm/miniflare 3.20230821.0 - 3.20231030.2npm
Published Dec 29, 2023
Tracked Since Feb 18, 2026