CWE-918 Server-Side Request Forgery (SSRF)
baseThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (4165)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-96655US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | ||||
| CVE-2026-96652US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the… | ||||
| CVE-2026-83548US | —OT kritisch | KEV | ||
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could pot… | ||||
| CVE-2026-64849US | —OT kritisch | KEV | ||
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/… | ||||
| CVE-2026-15410US | —OT kritisch | KEV | ||
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific… | ||||
| CVE-2026-15409US | —OT kritisch | KEV | ||
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the… | ||||
| CVE-2026-49869US | —OT kritisch | KEV | ||
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whiteli… | ||||
| CVE-2026-20230US | —OT kritisch | KEV | ||
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthentic… | ||||
| CVE-2026-32201US | medium6.5OT kritisch | KEV | ||
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-61884US | —OT kritisch | KEV | ||
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vu… | ||||
| CVE-2024-21893US | high8.2OT kritisch | KEV | ||
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an att… | ||||
| CVE-2023-41763US | —OT kritisch | KEV | ||
Skype for Business Elevation of Privilege Vulnerability | ||||
| CVE-2022-41040US | —OT kritisch | KEV | ||
Microsoft Exchange Server Elevation of Privilege Vulnerability | ||||
| CVE-2021-22054US | high7.5OT kritisch | KEV | ||
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. Thi… | ||||
| CVE-2021-39935US | high7.5OT kritisch | KEV | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5… | ||||
| CVE-2021-40438US | critical9.0OT kritisch | KEV | ||
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||||
| CVE-2021-34473US | high10.0OT kritisch | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2021-22175US | critical9.8OT kritisch | KEV | ||
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to expl… | ||||
| CVE-2021-21985US | critical9.8OT kritisch | KEV | ||
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCe… | ||||
| CVE-2021-21975US | high7.5OT kritisch | KEV | ||
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API… | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan