Description
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| budibase | server | < 3.41.3 | 3.41.3 |
References
- GitHub Security Advisory (GHSA-48x3-9ph2-p9gj) vendor-advisory
- VulnCheck Advisory: Budibase Server before 3.41.3 SSRF via Query Import third-party-advisory