Fallos del tipo CWE-918

3567 resultados

Server-Side Request Forgery (SSRF)

Ocorre quando a aplicação web busca conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Um atacante consegue fazer o servidor requisitar URLs não autorizadas — internas, administrativas ou de terceiros — aproveitando a confiança e as permissões que o servidor possui na rede.

Ejemplo

Um sistema permite gerar thumbnails de imagens externas: o usuário passa uma URL e o servidor faz o download. Um atacante envia 'http://localhost:8080/admin' e consegue acessar painéis administrativos internos que não deveria. Ou envia 'http://169.254.169.254/latest/meta-data' em ambientes AWS e rouba credenciais.

Cómo mitigar

Mantenha uma whitelist rigorosa de domínios e IPs permitidos; bloqueie ranges privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16) e metadados-servers por padrão; valide URLs antes de fazer requisições; use bibliotecas de parsing robustas; considere isolamento de rede para requisições externas.

CVE-2022-1767HIGHServer-Side Request Forgery (SSRF) in jgraph/drawioEPSS 1.8%CVE-2022-1784HIGHServer-Side Request Forgery (SSRF) in jgraph/drawioEPSS 1.8%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.8%CVE-2025-55150HIGHStirling-PDF SSRF vulnerability on /api/v1/convert/html/pdfEPSS 1.8%CVE-2022-43183HIGHXXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.EPSS 1.8%CVE-2023-24954MEDIUMMicrosoft SharePoint Server Information Disclosure VulnerabilityEPSS 1.8%CVE-2019-11897HIGHServer-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway SoftwareEPSS 1.8%CVE-2026-0560HIGHServer-Side Request Forgery (SSRF) in parisneo/lollmsEPSS 1.8%CVE-2025-36845HIGHAn issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSEPSS 1.8%CVE-2022-1723HIGHServer-Side Request Forgery (SSRF) in jgraph/drawioEPSS 1.7%CVE-2021-3959MEDIUMServer-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)EPSS 1.7%CVE-2022-2216CRITICALServer-Side Request Forgery (SSRF) in ionicabizau/parse-urlEPSS 1.7%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2022-34269HIGHAn issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blinEPSS 1.7%CVE-2026-27018HIGHGotenberg: Chromium deny-list bypass via case-insensitive URL schemeEPSS 1.7%CVE-2020-7329HIGHServer-Side Request Forgery (SSRF) in MVISION Endpoint ePO extensionEPSS 1.7%CVE-2017-15886—Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to dowEPSS 1.6%CVE-2022-0768HIGHServer-Side Request Forgery (SSRF) in rudloff/alltubeEPSS 1.6%CVE-2024-47883CRITICALButterfly has path/URL confusion in resource handling leading to multiple weaknessesEPSS 1.6%CVE-2023-21761HIGHMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 1.6%