Fallos del tipo CWE-918

3099 resultados

Server-Side Request Forgery (SSRF)

Ocorre quando a aplicação web busca conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Um atacante consegue fazer o servidor requisitar URLs não autorizadas — internas, administrativas ou de terceiros — aproveitando a confiança e as permissões que o servidor possui na rede.

Ejemplo

Um sistema permite gerar thumbnails de imagens externas: o usuário passa uma URL e o servidor faz o download. Um atacante envia 'http://localhost:8080/admin' e consegue acessar painéis administrativos internos que não deveria. Ou envia 'http://169.254.169.254/latest/meta-data' em ambientes AWS e rouba credenciais.

Cómo mitigar

Mantenha uma whitelist rigorosa de domínios e IPs permitidos; bloqueie ranges privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16) e metadados-servers por padrão; valide URLs antes de fazer requisições; use bibliotecas de parsing robustas; considere isolamento de rede para requisições externas.

CVE-2026-71280HIGHgo-shiori Server-Side Request Forgery via Unrestricted Bookmark URL FetchEPSS 0.3%CVE-2026-82246HIGHBudibase Server before 3.41.3 SSRF via Query ImportEPSS 0.3%CVE-2025-11361MEDIUMEssential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request ForgeryEPSS 0.3%CVE-2025-9414MEDIUMkalcaddle kodbox Download from Link serverDownload server-side request forgeryEPSS 0.3%CVE-2025-10695MEDIUMOpenSupports 4.11.0 — SSRF via test imap and smtp endpointsEPSS 0.3%CVE-2026-95930MEDIUMiFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgeryEPSS 0.3%CVE-2026-77522MEDIUMMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)EPSS 0.3%CVE-2024-22329MEDIUMIBM WebSphere Application Server server-side request forgeryEPSS 0.3%CVE-2026-76559MEDIUMWP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL HandlingEPSS 0.3%CVE-2025-30680HIGHA Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameteEPSS 0.3%CVE-2026-83543MEDIUMGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST EndpointEPSS 0.3%CVE-2026-33644LOWLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPsEPSS 0.3%CVE-2026-76361LOWServer-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAREPSS 0.3%CVE-2026-42860HIGHOpen edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointEPSS 0.3%CVE-2026-33537MEDIUMLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedEPSS 0.3%CVE-2025-1043MEDIUMEmbed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc ShortcodeEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-55591MEDIUMSignal K Server: Server-Side Request Forgery via Remote Connection EndpointsEPSS 0.3%CVE-2026-101005MEDIUMOctober CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgeryEPSS 0.3%