Fallos del tipo CWE-918

3567 resultados

Server-Side Request Forgery (SSRF)

Ocorre quando a aplicação web busca conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Um atacante consegue fazer o servidor requisitar URLs não autorizadas — internas, administrativas ou de terceiros — aproveitando a confiança e as permissões que o servidor possui na rede.

Ejemplo

Um sistema permite gerar thumbnails de imagens externas: o usuário passa uma URL e o servidor faz o download. Um atacante envia 'http://localhost:8080/admin' e consegue acessar painéis administrativos internos que não deveria. Ou envia 'http://169.254.169.254/latest/meta-data' em ambientes AWS e rouba credenciais.

Cómo mitigar

Mantenha uma whitelist rigorosa de domínios e IPs permitidos; bloqueie ranges privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16) e metadados-servers por padrão; valide URLs antes de fazer requisições; use bibliotecas de parsing robustas; considere isolamento de rede para requisições externas.

CVE-2021-25640—Open Redirect or SSRF vulnerability usage of parseURLEPSS 2.1%CVE-2021-33705HIGHThe SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request ForgerEPSS 2.1%CVE-2024-24806HIGHImproper Domain Lookup that potentially leads to SSRF attacks in libuvEPSS 2.0%CVE-2025-47733CRITICALMicrosoft Power Apps Information Disclosure VulnerabilityEPSS 2.0%CVE-2022-23206—Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthEPSS 2.0%CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 2.0%CVE-2023-37379—Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureEPSS 2.0%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 1.9%CVE-2026-40175MEDIUMAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainEPSS 1.9%CVE-2021-36043HIGHMagento Commerce Authenticated Blind SSRF Could Lead To Remote Code ExecutionEPSS 1.9%CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2022-35949MEDIUM`undici.request` vulnerable to SSRF using absolute URL on `pathname`EPSS 1.9%CVE-2025-54249MEDIUMAdobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 1.9%CVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2022-24969—bypass of CVE-2021-25640EPSS 1.9%CVE-2020-15152CRITICALServer-Side Request Forgery in ftp-srvEPSS 1.9%CVE-2022-2339CRITICALServer-Side Request Forgery (SSRF) in nocodb/nocodbEPSS 1.9%CVE-2024-38109CRITICALAzure Health Bot Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2026-54157CRITICALLobeHub: Unauthenticated SSRF in `/webapi/proxy`EPSS 1.8%CVE-2025-34282MEDIUMThingsBoard < v4.2.1 SVG Image SSRFEPSS 1.8%