CWE-918 — Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Common consequences
- Confidentiality: Read Application Data
- Integrity: Execute Unauthorized Code or Commands
- Access Control: Bypass Protection Mechanism
Mitigations
(none listed)
References
- CWE page: https://cwe.mitre.org/data/definitions/918.html
- CWE list: https://cwe.mitre.org/data/index.html
See all 1,245 pages under Weakness classes (CWE) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.