VYPR

CWE-918

Server-Side Request Forgery (SSRF)

BaseIncomplete

Description

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-664

CVEs mapped to this weakness (3,621)

page 63 of 182
  • CVE-2020-11987HigFeb 24, 2021
    Apache
    Batik
    risk 0.47cvss 8.2epss 0.13

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

  • CVE-2020-7329HigNov 11, 2020
    McAfee
    Mvision Endpoint
    risk 0.47cvss 7.2epss 0.02

    Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator.

  • CVE-2020-7328HigNov 11, 2020
    McAfee
    Mvision Endpoint
    risk 0.47cvss 7.2epss 0.02

    External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content for the attack has…

  • CVE-2020-24063HigNov 10, 2020
    Canto
    Canto
    risk 0.47cvss 7.2epss 0.01

    The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.

  • CVE-2020-14044HigAug 24, 2020
    Codiad
    Codiad
    risk 0.47cvss 7.2epss 0.03

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This…

  • CVE-2020-12725HigJun 11, 2020
    Redash
    Redash
    risk 0.47cvss 7.2epss 0.01

    Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP…

  • CVE-2020-11885HigApr 17, 2020
    risk 0.47cvss 7.2epss 0.01

    WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.

  • CVE-2018-20499HigDec 30, 2019
    GitLab Inc.
    GitLab
    risk 0.47cvss 7.2epss 0.01

    An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

  • CVE-2019-19999HigDec 26, 2019
    Halo Dev
    Halo
    risk 0.47cvss 7.2epss 0.02

    Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.

  • CVE-2018-13790HigJul 9, 2018
    Concrete5
    Concrete5
    risk 0.47cvss 7.2epss 0.01

    A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.

  • CVE-2017-18096HigApr 4, 2018
    Atlassian
    Application Links
    risk 0.47cvss 7.2epss 0.01

    The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF)…

  • CVE-2018-1000056HigFeb 9, 2018
    Jenkins Project
    Junit
    risk 0.47cvss 8.3epss 0.01

    Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service…

  • CVE-2017-14585HigNov 27, 2017
    Atlassian
    Hipchat Server
    risk 0.47cvss 7.2epss 0.04

    A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and…

  • CVE-2015-8813HigMar 3, 2017
    Umbraco
    Umbraco CMS
    risk 0.47cvss 8.2epss 0.10

    The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

  • CVE-2026-92566HigSep 16, 2026
    Datageartech
    Datagear
    risk 0.46cvss 8.2epss 0.00

    DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE…

  • CVE-2026-18424HigSep 15, 2026
    Concrete CMS
    Concrete CMS
    risk 0.46cvss 7.1epss 0.00

    Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained and reused for every later URL with…

  • CVE-2026-85164HigSep 3, 2026
    WWBN
    Avideo
    risk 0.46cvss 7.1epss 0.00

    WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud…

  • CVE-2026-76177HigSep 3, 2026
    Ocsinventory Ng
    Ocsinventory Ng
    risk 0.46cvss —epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters,…

  • CVE-2026-77348HigAug 31, 2026
    Ellite
    Wallos
    risk 0.46cvss 8.2epss 0.00

    Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' +…

  • CVE-2026-61638HigAug 31, 2026
    Wallos
    Wallos
    risk 0.46cvss —epss 0.00

    Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port.…