Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

Implementation, Operation

If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Implementation, Operation

If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Implementation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

79 results · Clear filters · Feed

High 7.2

CVE-2025-58179 Public exploit Scanner template

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…

withastro astro @astrojs/cloudflare npm

Sep 4, 2025
High 7.5

CVE-2025-27817 Public exploit Scanner template EPSS 70%

Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and …

Apache Software Foundation Apache Kafka Client druid thingsboard-tb-node Wolfi Maven

Jun 10, 2025
High 7.7

CVE-2025-27152 Public exploit

Possible SSRF and Credential Leakage via Absolute URL in axios Requests

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm

Mar 7, 2025
High 8.8

CVE-2025-21385 Public exploit EPSS 28%

Microsoft Purview Information Disclosure Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

Microsoft Microsoft Purview

Jan 9, 2025
High 7.4

CVE-2024-56800 Public exploit

Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious sit…

mendableai firecrawl

Dec 30, 2024
High 7.2

CVE-2024-54385 Public exploit Scanner template

WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.

princeahmed Radio Player

Dec 16, 2024
High 7.2

CVE-2024-54330 Public exploit Scanner template

WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.

hurraki Hurrakify

Dec 13, 2024
High 7.5

CVE-2024-48360 Public exploit Scanner template

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.…

Oct 31, 2024
High 8.8

CVE-2024-45507 Public exploit Scanner template EPSS 96%

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Apache Software Foundation Apache OFBiz

Sep 4, 2024
High 8.6

CVE-2024-39713 Public exploit Scanner template

Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

RocketChat Rocket.Chat rocket.chat npm

Aug 5, 2024
High 8.6

CVE-2024-34361 Public exploit

Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlockl…

pi-hole pi-hole

Jul 5, 2024
High 7.5

CVE-2024-38472 Public exploit Scanner template EPSS 69%

Apache HTTP Server on WIndows UNC SSRF

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access…

Apache Software Foundation Apache HTTP Server apache2 Alpine

Jul 1, 2024
High 8.2

CVE-2024-5736 Public exploit

SSRF in AdmirorFrames Joomla! Extension

Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.

Nikola Vasilijevski AdmirorFrames

Jun 28, 2024
High 7.2

CVE-2024-20404 Public exploit Scanner template EPSS 23%

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker …

Cisco Cisco Unified Contact Center Express Cisco Unified Contact Center Enterprise Cisco Packaged Contact Center Enterprise Network devices

Jun 5, 2024
High 8.1

CVE-2024-29415 Public exploit

ip SSRF improper categorization in isPublic

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

jupyter-base-notebook sqlpad pnpm-stage0 py3.10-jupyterlab Debian Ubuntu Wolfi npm

May 27, 2024
High 7.5

CVE-2024-34351 Public exploit Scanner template

Next.js Server-Side Request Forgery in Server Actions

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

vercel next.js jitsucom-jitsu-console next Wolfi npm

May 9, 2024
High 8.1

CVE-2024-22262 Public exploit

CVE-2024-22262: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html a…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Apr 16, 2024
High 7.5

CVE-2024-27620 Public exploit

An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request…

Apr 6, 2024
High 8.2

CVE-2024-21893 Exploited · Ransomware Public exploit Scanner template EPSS 100%

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Polic…

ivanti IPS ICS Network devices

Jan 31, 2024
KEV Jan 31, 2024
High 8.8

CVE-2023-49471 Public exploit

Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not valida…

Jan 10, 2024
High 7.5

CVE-2023-45966 Public exploit

umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.

Oct 23, 2023
High 8.8

CVE-2023-46229 Public exploit EPSS 48%

LangChain Server Side Request Forgery vulnerability

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

langchain PyPI

Oct 19, 2023
High 7.5

CVE-2023-36661 Public exploit

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyI…

xmltooling xmltooling Debian Ubuntu

Jun 25, 2023
High 8.1

CVE-2023-28288 Public exploit

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

Apr 11, 2023
High 7.5

CVE-2023-25262 Public exploit

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting …

Mar 28, 2023
High 7.5

CVE-2021-36396 Public exploit

Moodle vulnerable to Server-Side Request Forgery

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

moodle/moodle moodle Web / CMS Ubuntu Packagist

Mar 6, 2023
High 8.8

CVE-2023-22493 Public exploit

RSSHub is vulnerable to SSRF (Server-Side Request Forgery)

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker ca…

DIYgod RSSHub rsshub npm

Jan 13, 2023
High 8.8

CVE-2022-4096 Public exploit

Server-Side Request Forgery (SSRF) in appsmithorg/appsmith

Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.

appsmithorg appsmithorg/appsmith

Nov 21, 2022
High 8.8

CVE-2022-41040 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 7.5

CVE-2022-40146 Public exploit

Jar url should be blocked by DefaultScriptSecurity

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven

Sep 22, 2022
High 8.6

CVE-2022-31188 Public exploit EPSS 48%

Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in …

cvat-ai cvat

Aug 1, 2022
High 7.5

CVE-2021-40822 Public exploit Scanner template EPSS 19%

GeoServer allows SSRF via the option for setting a proxy host

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

org.geoserver:gs-main Maven

May 1, 2022
High 7.5

CVE-2021-22054 Exploited Public exploit Scanner template EPSS 100%

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and…

Dec 17, 2021
KEV Mar 9, 2026
High 7.1

CVE-2021-27905 Public exploit Scanner template EPSS 93%

SSRF vulnerability with the Replication handler

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loc…

Apache Software Foundation Apache Solr lucene-solr lucene-solr Debian Ubuntu Maven

Apr 13, 2021
High 7.2

CVE-2021-21311 Exploited Public exploit Scanner template EPSS 98%

SSRF in adminer

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is …

vrana adminer adminer adminer Debian Ubuntu Packagist

Feb 11, 2021
KEV Sep 29, 2025
High 8.2

CVE-2020-7740 Public exploit

Server-side Request Forgery (SSRF)

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an…

node-pdf-generator npm

Oct 6, 2020
High 7.5

CVE-2019-0227 Public exploit EPSS 92%

Server Side Request Forgery in Apache Axis

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from so…

Apache Apache Axis 1.4 axis org.apache.axis:axis Debian Ubuntu Maven

May 1, 2019
High 7.5

CVE-2019-9621 Exploited Public exploit Scanner template EPSS 81%

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x …

Apr 30, 2019
KEV Jul 7, 2025
High 7.5

CVE-2017-3164 Public exploit EPSS 19%

Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reac…

Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven

Mar 8, 2019