CVE-2020-15879

—

CVSS 3.1

7.5 high

EPSS

3%p85

Published

Jul 21, 2020 (Jul 21, 2020)

Modified

Jun 17, 2026

Description

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).

Vendors: bitwarden
Products: server
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.7%)

In the news0 stories

No ingested article mentions this CVE yet.